Overview

overview

7

Static

static

3

b22c9e3d0f...99.exe

windows10-2004-x64

7

b22c9e3d0f...99.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 08:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
  • Size 6.0MB
  • Sample260928-klsacazcle
  • SHA256 b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE52B.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5884
      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:6084
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE886.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3300
          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5908
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECEB.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5924
              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:856
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF037.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6068
                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4224
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF40F.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3260
                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1640
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF78A.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:52
                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5800
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC3D.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4396
                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2748
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A6.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2900
                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2484
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a611.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3520
                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:3240
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99B.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2396
                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:1740
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC79.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4340
                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2292
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1061.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:752
                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1484
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a138E.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1948
                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5624
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16E9.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3384
                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2148
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A54.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3408
                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1176
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D52.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2212
                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1148
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2011.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5936
                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4880
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a233E.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3400
                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2188
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a261C.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5084
                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:300
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2939.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4668
                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5104
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A23.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4792
                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:6088
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AFE.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1308
                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:6092
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BE8.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5440
                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:248
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D02.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5772
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3744
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E0B.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2232
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1192
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F15.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5916
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5532
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a302E.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4136
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:6108
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3167.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5692
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4448
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3270.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4236
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:692
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33A9.bat
                                                                                                                          60⤵
                                                                                                                            PID:8
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4576
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34D2.bat
                                                                                                                                62⤵
                                                                                                                                  PID:4768
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2388
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35DB.bat
                                                                                                                                      64⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:3848
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2296
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36D5.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:2932
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            67⤵
                                                                                                                                              PID:1472
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5364
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37CF.bat
                                                                                                                                                68⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:6012
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4512
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38AA.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4424
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:992
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3994.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:2804
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5352
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3ACD.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:3324
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4964
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BA8.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:5012
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:5596
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C82.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                          PID:3012
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:5576
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D4D.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                                PID:3432
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:3424
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E67.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2644
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3696
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F32.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:980
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:6100
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a406A.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                                PID:1052
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:4616
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4135.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                      PID:5008
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4716
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4220.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4580
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:2448
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4329.bat
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:2692
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:1912
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4423.bat
                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                    PID:1976
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:1848
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a451D.bat
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:1720
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45F8.bat
                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2780
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:4860
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4731.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                  PID:4408
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:5432
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a482B.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:5016
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:2508
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4905.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:1708
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:1120
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49FF.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                  PID:3304
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:5992
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ABB.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                        PID:3724
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:4392
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BC5.bat
                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:1280
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:5932
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CBF.bat
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:3548
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:4104
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DA9.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EB3.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                          PID:1468
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:4480
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FAD.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:1036
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:3844
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50B6.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                    PID:1964
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:1476
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51B0.bat
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                          PID:2952
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:4088
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a529B.bat
                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:5272
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5366.bat
                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                    PID:2628
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                        PID:2744
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5431.bat
                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:5756
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:1816
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a550C.bat
                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:1184
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:1392
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55E6.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:4884
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56E0.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                              PID:2028
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5819.bat
                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                  PID:5876
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                                      PID:1900
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5932.bat
                                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                                          PID:2456
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A2C.bat
                                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                                PID:5684
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:5356
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B07.bat
                                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4864
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:4320
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BE2.bat
                                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:416
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:2656
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CBC.bat
                                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3084
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4336
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DA7.bat
                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:472
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E62.bat
                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6028
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:424
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F1E.bat
                                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1284
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6008.bat
                                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5956
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:4844
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60D3.bat
                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:3344
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:3600
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a649C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6596.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6661.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a673C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6845.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6911.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3156
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BB0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CAA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E31.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F0C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7092.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a719C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7258.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7342.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a741D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a768E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7768.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7843.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C5A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F87.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8061.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a813C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8284.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8320.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8563.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a863D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8776.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8802.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AA2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C87.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DBF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9040.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9159.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9205.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a932E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9466.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9503.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a960C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9783.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a984E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9987.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ACF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA01E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA09B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA118.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA186.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA203.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA32C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA399.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA426.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA53F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                            PID:5704
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                              PID:5736
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                  PID:1472
                                                                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                            PID:5152
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:2628

                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                              $$a1061.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1061.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 ace1658d75320b5d0500b801ecbeae80105c6cfd38007f1ccf30c505b4a9c1a8
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a138E.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a138E.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 2d7fe677c058f3f19f765f08654f432bae2dca712f6db63c5fdfd8f5e8f98f2a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a16E9.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a16E9.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 a8418f83c329257fe26d6629aa0ab75908e8a4e739eb5c228a9021b4970dfe52
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a1A54.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1A54.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 7823afe20d1512c2aaa85264310786960e014715b9c97ff368a483ebaf73191d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a1D52.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1D52.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 0076b23790f27886c37d5bc9dd511d8e7fcc4dedbf79c35089880bee96e08669
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a2011.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2011.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 85a1eafb007cac88b4bb0425f1876195af7bbc6949348c5746d60f05b894f259
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a233E.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a233E.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 93805cfea0f1c878aa2fcce43863dbd3eb429ac70dc8ed3370b9fda5ff59057a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a2A6.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2A6.bat
                                                                                                                                                                                                                                                                              • Size 721B
                                                                                                                                                                                                                                                                              • SHA256 6f792280025874ffbbb4256db1dd165b98a4958e30daad21e2880fd69d15b0d8
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a611.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a611.bat
                                                                                                                                                                                                                                                                              • Size 721B
                                                                                                                                                                                                                                                                              • SHA256 3b87b76229b948e571a27eb24be8b03fcfeba87a0de2f0bdf33efcc3d06a2c5e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a99B.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a99B.bat
                                                                                                                                                                                                                                                                              • Size 721B
                                                                                                                                                                                                                                                                              • SHA256 2515cd37e9add46d5030c68c8b7622d64aa5f969b1252a3fd7954a000acf657d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aC79.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC79.bat
                                                                                                                                                                                                                                                                              • Size 721B
                                                                                                                                                                                                                                                                              • SHA256 39ce1589284c4da2bdbec922e3a39df4f0065f267264ba3de653eab23fc03314
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aE52B.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aE52B.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 f8056f9216f7b389cda7238086640691a869034a491a47853bdd0b050a8b6d52
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aE886.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aE886.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 3244de25222b97bcb2cf7587903b709e19d55ee54b87ebe223d2bfa9a960f58b
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aECEB.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aECEB.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 593f4bbaf87d67163a394f3765264e78aa8fb8e40e9cbe9bcbcf7c49a3518bcc
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aF037.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aF037.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 a2cbefb9cb341a40cf347c6ec2d8562dfc3d21a054e59d4603d4bf9031a48a98
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aF40F.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aF40F.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 ff19debdaab8e7a7d3d1ff4f6eadf782c54466a3190a177a5462f33443acf1f9
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aF78A.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aF78A.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 7f3ef746f4fa6eec3d2f987c800cc5a2f30dec9310a5bce71c32e3d861d8bb6f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aFC3D.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aFC3D.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 ed4a943e5b74f07f38cb669af59bb984d3b76fde7952da345e973aee81557f5b
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.9MB
                                                                                                                                                                                                                                                                              • SHA256 bfa1990efe0f81f2b961354ad01d7e32f2c369b73ded9a2fae61a10f29d32dbd
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.9MB
                                                                                                                                                                                                                                                                              • SHA256 28001d0e322353af338b82c4276d6cf35906948540df95378f741848b094d0f4
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 6.0MB
                                                                                                                                                                                                                                                                              • SHA256 b7e62d1d45281f7583d353103bfc4c9191f8b9e092ccf0edcb421b10d8930935
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                                              • SHA256 9263044b8922b078cc329f4513fe86c16b0ec4022d1589f0d305c2c08b7472f7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                                              • SHA256 b86779e7e172ad4c7e3f8dc7e44d2e63c3a4c80faaa8984efdf0d7d23b041cc4
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                                              • SHA256 d06f654e9e282c3784a1237d35572be4b2766145b159bdd23b9d949a176c869a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.8MB
                                                                                                                                                                                                                                                                              • SHA256 db409704a9cb504f4a54831bc348357fbbc302521dfb085ebbda778b94771ca0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.8MB
                                                                                                                                                                                                                                                                              • SHA256 cf54150009eda45dc9c76320767d693653446c3430ccf4b15d83db9963cdfa1d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.7MB
                                                                                                                                                                                                                                                                              • SHA256 1fbe7f208d96a55a5160b97526aff29e68399654a35d3d9f57b8d856bc2d0544
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.8MB
                                                                                                                                                                                                                                                                              • SHA256 5f3c0be7f425d82f871d6235f3731b4df64242159f08aeb9dc7185c46fb7c674
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.7MB
                                                                                                                                                                                                                                                                              • SHA256 611b9dfdd6754bff02582a0f66f3ad7eb398f3ea127ad5f4432746dd4c719321
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                                              • SHA256 f1883acc2760a89a0cb446d486b8b4319847502c0ce9f4d07b46e7ba99eef695
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.7MB
                                                                                                                                                                                                                                                                              • SHA256 6c3adedfb68f2d52e168a6c3bb623c8993394bd3708d9fc40ca81bfb9ba80137
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                                              • SHA256 b7a9c5ee56fc26015319ebaff86f7bb9a80dbd8bd7daee18c5ff76f12d9021a6
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                                              • SHA256 70eff9dae516aef75652d1d88c7250e40735562017b81b6e6546338680d8d3b0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                                                              • SHA256 b39fbebfbf476bf2f935a4c338159c792d737a959b47a427171d758c72cb22a2
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.9MB
                                                                                                                                                                                                                                                                              • SHA256 20111bc90c47992f49002bdba85a55ff954e54ef7d282efc37a8a4a81515e9a2
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.9MB
                                                                                                                                                                                                                                                                              • SHA256 8912be5d036b7d0fc041b909a23efbb95a22c816f8a450b8165b9040e427319f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Dll.dll
                                                                                                                                                                                                                                                                              • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                              • Size 68KB
                                                                                                                                                                                                                                                                              • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Logo1_.exe
                                                                                                                                                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              _desktop.ini
                                                                                                                                                                                                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-2251218687-1689653882-3767565116-1000\_desktop.ini
                                                                                                                                                                                                                                                                              • Size 9B
                                                                                                                                                                                                                                                                              • SHA256 918b1655c9319d78d9f5801608ae25b42e9cbb99cfe2671ee37ac122a938d764
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              memory/248-898-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/252-1265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/300-877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/424-1175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/692-931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/856-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/992-961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1120-1046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1128-1470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1132-1620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1148-855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1176-847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1192-908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1336-1283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1392-1114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1416-1572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1476-1086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1484-823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1508-1096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1516-1482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1552-1506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1564-1247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1640-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1648-1337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1720-1026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1740-803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1784-1235-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1816-1108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1840-1391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1848-1021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1900-1133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1904-1488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1912-1016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2028-1127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2148-839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2188-921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2188-871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2216-1307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2292-813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2296-946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2316-1241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2384-1343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2388-941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2424-1608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2448-1011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2468-1542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2484-777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2508-1041-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2536-1518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2604-1385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2636-1295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2656-1157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2708-1452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2744-1102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2748-769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2796-1614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2836-1536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2840-1554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2876-1602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2884-1379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3028-1349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3048-1512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3116-1223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3156-1253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3224-1494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3240-792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3264-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3264-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3268-1416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3312-1325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3364-1181-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3380-1410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3404-1398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3424-986-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3440-1361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3448-1548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3480-1422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3492-1277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3508-1464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3568-1476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3600-1193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3616-1434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3676-1428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3696-991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3744-903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3844-1081-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3872-1458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4088-1091-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4104-1066-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4172-1373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4220-1205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4224-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4260-1560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4280-1071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4292-780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4292-764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4292-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4300-1500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4320-1151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4336-1163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4344-1199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4392-1056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4448-926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4480-1076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4508-1367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4512-956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4560-1590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4564-1331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4576-936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4616-1001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4632-1259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4660-1139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4676-1578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4708-1319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4716-1006-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4772-1530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4796-1271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4812-1169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4824-1211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4832-1440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4836-1229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4844-1187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4860-1031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4880-863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4884-1120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4892-1404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4964-971-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4968-1355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5080-1566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5104-882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5256-1626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5352-966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5356-1145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5364-951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5432-1036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5532-913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5576-981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5596-976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5616-1584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5624-831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5624-893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5664-1596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5704-872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5704-914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5716-1446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5800-117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5824-1313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5900-1301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5908-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5932-1061-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5948-1524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5992-1051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6048-1217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6072-1289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6084-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6088-887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6092-892-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6100-996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6108-915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/6108-920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download