Overview

overview

7

Static

static

3

b9a0008337...6c.exe

windows10-2004-x64

7

b9a0008337...6c.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 23:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
  • Size 5.0MB
  • Sample260929-3kf5sshf22
  • SHA256 b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E88.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1316
      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2868
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36B6.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5076
          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2308
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B69.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:240
              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:5180
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40A9.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5052
                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4472
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4329.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5720
                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5068
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D0D.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2796
                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4596
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a551B.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5660
                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3744
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BC2.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1220
                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4540
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D56.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1512
                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4364
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AF3.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3020
                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1356
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EAC.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4468
                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:3980
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85A1.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2824
                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5788
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a893B.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3432
                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2096
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4356
                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3296
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9754.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5128
                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5904
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9977.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5824
                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4560
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C84.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2648
                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:6116
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F53.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2428
                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5360
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA241.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4436
                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2104
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA520.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5764
                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4076
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA752.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3720
                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2480
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA994.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2364
                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2496
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA8E.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1448
                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2500
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB88.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4544
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1776
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC53.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5088
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:980
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD1E.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2512
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4660
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE47.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5688
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2812
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF03.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2408
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:364
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFFD.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4624
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3908
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0E7.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:6128
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4196
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1F1.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4896
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:3828
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2EB.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:4120
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:684
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3D5.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:992
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:200
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB50E.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:5196
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:5792
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5E8.bat
                                                                                                                                                70⤵
                                                                                                                                                  PID:5596
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:5108
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6A4.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5376
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:5092
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB77F.bat
                                                                                                                                                          74⤵
                                                                                                                                                            PID:996
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1604
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB888.bat
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:5508
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4744
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB953.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:3624
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2568
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA4D.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4948
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:820
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB67.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:1296
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4240
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC41.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4412
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3976
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD3B.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1224
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:1276
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE55.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5400
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF5E.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:2100
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:1288
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC01A.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0E5.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                              PID:4488
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1EF.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:1280
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:3172
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2E9.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:2692
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3F2.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                            PID:6100
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:3584
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4EC.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:5912
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:4300
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5C7.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                      PID:3332
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:3236
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC692.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                            PID:1428
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:1876
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC76D.bat
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:5032
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:124
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC838.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:916
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:5656
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC942.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:5692
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA2C.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:3384
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB45.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:2380
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC10.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:1228
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:3416
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD1A.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:2964
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2300
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDF5.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:1368
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:6044
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEDF.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:4644
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFAA.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:2032
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:2576
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0A4.bat
                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                              PID:4792
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD17F.bat
                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                      PID:1656
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                          PID:6020
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD25A.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                  PID:4592
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD354.bat
                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                      PID:5852
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                          PID:2620
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD41F.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                              PID:3068
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                  PID:1392
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4EA.bat
                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:3188
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:3192
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5E4.bat
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                          PID:4940
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:5016
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6BF.bat
                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                PID:3916
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1524
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7C8.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:2008
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:2160
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8B3.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4428
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:5008
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD97E.bat
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:2544
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:856
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA78.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:4400
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5856
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB53.bat
                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:1584
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC2D.bat
                                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:572
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:1128
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCF8.bat
                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:4480
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4440
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDA4.bat
                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:4484
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:2548
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE60.bat
                                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:4292
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF0C.bat
                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE15D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE229.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE46B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE555.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE630.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:824
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE71A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE805.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE98B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC5A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED06.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDC1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF061.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF12C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF340.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF488.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF553.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF60E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF766.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF831.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF999.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAD1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCF4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a149.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a428.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a551.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a699.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a754.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a810.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a967.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4704
                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Creates a file in the Startup directory
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                    PID:4732
                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                      PID:1780
                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:5840

                                                                                                                                                                  Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                        Reconnaissance

                                                                                                                                                                        Resource Development

                                                                                                                                                                        Initial Access

                                                                                                                                                                        Execution

                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                        1
                                                                                                                                                                        T1059

                                                                                                                                                                        Windows Command Shell

                                                                                                                                                                        1
                                                                                                                                                                        T1059.003

                                                                                                                                                                        Persistence

                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                        1
                                                                                                                                                                        T1547

                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                        1
                                                                                                                                                                        T1547.001

                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                        1
                                                                                                                                                                        T1547

                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                        1
                                                                                                                                                                        T1547.001

                                                                                                                                                                        Defense Evasion

                                                                                                                                                                        Credential Access

                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                        1
                                                                                                                                                                        T1555

                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                        1
                                                                                                                                                                        T1555.003

                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                        1
                                                                                                                                                                        T1552

                                                                                                                                                                        Credentials In Files

                                                                                                                                                                        1
                                                                                                                                                                        T1552.001

                                                                                                                                                                        Discovery

                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1120

                                                                                                                                                                        Query Registry

                                                                                                                                                                        1
                                                                                                                                                                        T1012

                                                                                                                                                                        System Information Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1082

                                                                                                                                                                        System Location Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1614

                                                                                                                                                                        System Language Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1614.001

                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1016

                                                                                                                                                                        Lateral Movement

                                                                                                                                                                        Collection

                                                                                                                                                                        Data from Local System

                                                                                                                                                                        1
                                                                                                                                                                        T1005

                                                                                                                                                                        Command and Control

                                                                                                                                                                        Exfiltration

                                                                                                                                                                        Impact

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        $$a2E88.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2E88.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 63a802ded93152ded48b9025a559abd1e3a50234560ccc7a26faa32388c66d0f
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a36B6.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a36B6.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 86a7cb078da232b32931e1b627f4f972d7e78ad122bcadf0759f0f812241cee5
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a3B69.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3B69.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 88a15b4d6f4d32ba24e9b278cd426f3a9164ce4ec955081dd628d387330ce5d6
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a40A9.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a40A9.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 c12af88ff591869ef217ea8cceafed4079a49801367efab14d160e11712a8aec
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a4329.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4329.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 72a243e301f2ab62c4a277c56cd502ebaa7c91116b87e8e8ccd157e64bfa31d8
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a4D0D.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4D0D.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 75d1e715ff58ffd59f44dd2987df162e30e77b628227211d0dfb1d0338c51ad5
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a551B.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a551B.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 0cb1481f93c45dc1e98b597e848278539a697e063aa1cea11f7209ce268aa94a
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a5BC2.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5BC2.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 1507ad3881d26e9006fbdd1f0f66a3ef8f8510d1133ae8d9145b4afb4a6d04b8
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a6D56.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6D56.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 97c65d0e0f4f0b3e229a6e5d2a5894f72e7c334cbddf956d526c851bd39e399e
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a7AF3.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7AF3.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 f47172162ff5c352f715c72e2ae9e7275d33c10b78efeb77268bb224b2f550d9
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a7EAC.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7EAC.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 f16acdb82987853792437a5480e9136fb713cfc98d5bd1b31dee03be5575384d
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a85A1.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a85A1.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 ab759612d9816e62d125a28821c9f452c2914a5ab06ef47e6641e6079837393e
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a893B.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a893B.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 948cba5ea4e62f91148f463a39f2456b7ef7ea4f45019d6b38c0216a279a31f7
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a8C39.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 41b17568b3041ec74ce2fe59934150c57b94e25c4b5f663fdc578012da0cc498
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a9754.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9754.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 de758218405e6edb7e24143057abf7c1dee362267ce0b90c8b4037039c183d51
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a9977.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9977.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 998c1f1117a3912b098a6e87dd45803210d46ea713221cecec1b127bec151bdb
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a9C84.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9C84.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 90e5b37c2c16446675db1a2560143ace17eae8e48e7c663a257107eb5c18c737
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a9F53.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9F53.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 2ecf6d1a6038a702faa3448de1f37e4107c04ec73224ac496434b62fae6aca6f
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aA241.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA241.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 2c8e3780bda40fbd35746b038df2f30060edfd897c8e000f9d4a201864d5839a
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aA520.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA520.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 788189f4440fb1d17f969d9c25526e6d6bd50c97e10e8419b51e01a5e90d7b62
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aA752.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA752.bat
                                                                                                                                                                        • Size 722B
                                                                                                                                                                        • SHA256 ebfac1ce2df463b2aba006bd3390954d080f01661754730fa6263a7a9f6133ec
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                        • SHA256 c83abec370c391f80e694154e218cbe1595c7cbc7bc3dbfa6485bccac9f20918
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                        • SHA256 50fea263115f33d5bfff5d76f10c016a6420e9c4153af9071ed777380c9873e8
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                        • SHA256 496778d9988987b46c5abb3ec67734477f1064d7e36114dc6f766c70d96f3d01
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                        • SHA256 caf6e6642ce25e2a8b5915de27d6dd32882996af88f0f2934adfa22f3e60faff
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                        • SHA256 5236042609a93d6be2cd0f0126843bbfaa4d44c1e4afbc137a14e20014a54618
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.6MB
                                                                                                                                                                        • SHA256 0ec5eff25f046110840bb0a4621524d29d75066ff5ad0874ca6c7a92f53c8f48
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.5MB
                                                                                                                                                                        • SHA256 fa73263ff13246d1147dbb1ae1740ea7da990d2178d4de32489abe844747ddc3
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                        • SHA256 fbf792f45f807d36d416d93ef3747388e62a936d442541435511eb8d4f4dad76
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.6MB
                                                                                                                                                                        • SHA256 b5d6e91a6d03c7e75cd0f62ba9ae951bc8d781225b0ef63b69c15fc9845ccfbd
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.5MB
                                                                                                                                                                        • SHA256 7d3a706345ac50e0f4141b2b0b2588c0bd39c133e642117114a8ec3f6b273e41
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.4MB
                                                                                                                                                                        • SHA256 7d5ad6e45475a4b084cdfbb527be43eca30804fb7d124b4520291ca73f801380
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.6MB
                                                                                                                                                                        • SHA256 0ef685f06ff7a0ccc9d9383aab7da9b5c9aeea211ca984f11553daee64894767
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.5MB
                                                                                                                                                                        • SHA256 2ee4353a41a86fba77ae53ed3d0c6d47ad7eedab6e1636782fff162f44931307
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.4MB
                                                                                                                                                                        • SHA256 8f04e968c9ce8d2771af9e2c22d47dda7aa48603d996a79127ba0ffc64c1176d
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.4MB
                                                                                                                                                                        • SHA256 6e9c5dee74470bb313df57c2752bba768a767d391d422973b901091005ce6d0d
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                        • SHA256 347b21f66967c5f0ae29e0dc266880b9201553543b20f01085e2c043bf7c3217
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.3MB
                                                                                                                                                                        • SHA256 1c615d491b65227549d654688259bb07fc4ef802d6c6fc66521c562aa07e18f2
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                        • SHA256 ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                        • SHA256 2b5ce0aa33dfe438fcbf70a3533b631833ce9c07b872a82044a28257c73862bb
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b9a00083371df3366fb3c6d3771c5887c2c35dbc2fd6623f8b7b5a8c6914076c.exe.exe
                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                        • SHA256 5f1c9737f8c0533ded7e7a1d2432b5d402f26f44b20db88d318b8e7991551fef
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                        • Size 32KB
                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        _desktop.ini
                                                                                                                                                                        • Path F:\$RECYCLE.BIN\S-1-5-21-4154726816-2055034831-2297277433-1000\_desktop.ini
                                                                                                                                                                        • Size 9B
                                                                                                                                                                        • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        memory/124-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/200-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/244-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/364-8154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/456-8663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/684-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/820-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/856-8398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/900-8789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/920-8482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/980-8139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/984-8524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1088-8699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1128-8416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1184-8500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1276-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1288-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1332-8446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1356-5570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1392-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1524-8380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1560-8717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1584-8410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1604-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1776-8134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1864-8452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1876-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2068-8795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2096-6059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2104-8105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2160-8386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2236-8723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2248-8627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2260-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2300-8315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2308-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2316-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2332-8458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2380-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2480-8119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2496-8124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2500-8129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2504-8759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2548-8428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2568-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2576-8332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2620-8356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2812-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2828-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2868-26-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2956-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2976-8729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2988-8765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3008-8554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3052-8802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3052-8808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3120-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3172-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3192-8368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3228-8609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3232-8681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3236-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3276-8651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3280-8621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3296-8062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3300-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3364-8747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3384-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3412-8434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3416-8310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3492-8591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3584-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3744-1843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3828-8169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3868-8801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3876-8633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3908-8159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3976-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3980-6039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4076-8113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4152-8470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4156-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4156-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4172-8735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4184-8603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4196-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4208-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4240-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4248-8597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4300-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4360-8711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4364-5471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4384-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4396-8687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4440-8422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4472-62-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4492-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4508-8657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4524-8753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4540-3442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4560-8080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4592-8350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4596-1469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4644-8326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4656-8476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4660-8144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4664-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4672-8783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4688-8669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4732-712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4732-1759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4732-8100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4732-5563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4732-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4744-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4764-8338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4796-8464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4936-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4956-8440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4960-8578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5008-8392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5016-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5068-721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5092-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5108-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5156-8548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5180-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5200-8675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5320-8741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5360-8096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5428-8645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5448-8615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5656-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5684-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5692-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5772-8777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5788-6051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5792-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5812-8693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5820-8705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5856-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5904-8070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5916-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5948-8639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5984-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/6020-8344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/6044-8320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/6084-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/6116-8088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download