Overview

overview

8

Static

static

3

b75820faef...62.exe

windows10-2004-x64

8

b75820faef...62.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/09/2026, 23:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
  • Size 5.9MB
  • Sample260929-3mae2atzcs
  • SHA256 b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecution

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:980
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a822B.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83B2.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3804
          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1420
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8911.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:956
              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4028
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91DB.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3396
                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4160
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8AF.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4988
                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2896
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB2D.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2248
                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1080
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9A4.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1704
                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4776
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDABB.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3516
                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:3012
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA97.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1632
                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3856
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB2.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4944
                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:5112
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BCB.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1720
                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2016
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27C2.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4576
                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4188
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39C3.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3456
                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:544
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FCC.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2584
                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2096
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60E3.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2512
                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4716
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BEF.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4344
                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2240
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a773A.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4336
                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4436
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1708
                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2428
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A73.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1612
                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4812
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a935D.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2772
                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2668
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93BA.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1764
                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3580
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9409.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1988
                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4768
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9457.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3732
                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3276
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94A5.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4992
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2988
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9512.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4580
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4940
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9570.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2376
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4424
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95CE.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1100
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5024
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a961C.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2180
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4784
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a967A.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2300
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:1484
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96D7.bat
                                                                                                                          60⤵
                                                                                                                            PID:1508
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2004
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9735.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:4740
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4904
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9793.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:4312
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:1192
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97F1.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:2036
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1928
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a984E.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:1068
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:696
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a989C.bat
                                                                                                                                                    70⤵
                                                                                                                                                      PID:4260
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:3520
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98EB.bat
                                                                                                                                                          72⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:824
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:4620
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9968.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:1092
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:64
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99B6.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3976
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:2360
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                          PID:1200
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:2824
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A71.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                                PID:2444
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:5008
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ACF.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                      PID:1456
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                        83⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:1980
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B2D.bat
                                                                                                                                                                                          84⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:1260
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:984
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B8A.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                                PID:3164
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2568
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BE8.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4376
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:2152
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C65.bat
                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                          PID:1256
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:3644
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CB3.bat
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                PID:756
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:916
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D11.bat
                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                      PID:2264
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D6F.bat
                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:1144
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4896
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DBD.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                PID:1156
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:1892
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:3672
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E78.bat
                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                          PID:2268
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:4464
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ED6.bat
                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:5020
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:4068
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F34.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:1728
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:1948
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FA1.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:2744
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:3488
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA01E.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                            PID:2664
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:4600
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0AB.bat
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                  PID:1852
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:1000
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA118.bat
                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3400
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA176.bat
                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                              PID:1876
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4432
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1E3.bat
                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                    PID:848
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:1060
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA251.bat
                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                          PID:1760
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:4400
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2BE.bat
                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:3524
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA31C.bat
                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:4680
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:3228
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA389.bat
                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:3056
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                            PID:384
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3E7.bat
                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:4704
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                  PID:4268
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA454.bat
                                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:2964
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4C2.bat
                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:752
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                            PID:2960
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA52F.bat
                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                PID:820
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                                    PID:4340
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:1868
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:4996
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA639.bat
                                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:4592
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                                              PID:2524
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6A6.bat
                                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2460
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA704.bat
                                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:2784
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4676
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA762.bat
                                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:1040
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:3812
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7CF.bat
                                                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:4572
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2496
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA83C.bat
                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4556
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:3200
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8AA.bat
                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4240
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8F8.bat
                                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:2956
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3656
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA956.bat
                                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3952
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA02.bat
                                                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAACD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB79.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABD6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC34.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC82.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:944
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF51.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFFD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB05B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB106.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB164.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB210.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB26E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB31A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB368.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB414.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB471.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB51D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB57B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB627.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB685.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB721.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB78E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB83A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB898.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB953.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA1F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBACA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB19.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB76.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC80.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCDE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE93.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC068.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC181.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC23D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC327.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC431.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC49E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC54A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC598.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC634.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC692.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC72E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC77C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC819.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC876.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC903.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC970.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA1C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5708
                                                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                        PID:868
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                          PID:3892
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:752
                                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                        PID:1176
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:4864
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 1020
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 1020
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:2008
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1176 -ip 1176
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:4472
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1176 -ip 1176
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:5088

                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                $$a1BCB.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1BCB.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 de87cfe29cfae6ded2f2925b07091423b825c9a6859e50aedf633bd5638288b6
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a27C2.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a27C2.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 117686183781d5a7761caf198b98001e5280ed2643d9813c481385a5d7fec6f3
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a39C3.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a39C3.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 39f2eb8c25cc4eef87df2caa6963ad32d9ede21eb92e0e739b4cce81ec164b1e
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a4FCC.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4FCC.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 d0751fb39831b241b49a4089aabf4c9437c75063349f0fd2888169e68234d57a
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a60E3.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a60E3.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 4e5a45801c7926d98028a2db3fceaaa1b44c32ec081795facd797c2f872255d7
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a6BEF.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6BEF.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 91f535001750329b29fa9f49913db8066c49cebc9a5bed40829b5a5a5fa37183
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a773A.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a773A.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 8a6605ac9dfdf7bfb4605da3f9bef5ddda868f3a3f771b19d18093564f01b957
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a822B.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a822B.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 bc2af85741c088ad3327421b62987d3f7b159299a8becd7f4c3a827484dbce8b
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a8294.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 ffa35982b368eb79893cd9342ea9ad96323b890e921aedc7d780cdd17006b33a
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a83B2.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a83B2.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 670aeedb4f0b558e48a49c16e328a03e8b25e1ac2eec9029db66c9a09bc61008
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a8911.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8911.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 a3a73c67450786b781bf3eb295544e7db160ee42485ebf1a0d941913aae7ad40
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a91DB.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a91DB.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 aee5ce1a9e452fed52e0c685a21159734aba42fdbad96970fef6ef256e307c9e
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aA8AF.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA8AF.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 4834c40a2ea3c7cce9a1859a4a134565e2e8b6af733790045458a36dc7e29bb1
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aBB2D.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBB2D.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 ddc6688d88f1f8cedc9ced14d99c67f81c3cf807e0929bcf0cc50c439767fd60
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aC9A4.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC9A4.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 f49c0a80eaaff71ea872077c598856956741d9d22185029f746ebdef8bf6d329
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aDABB.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aDABB.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 2d222123413049d5b60284b0f872ebfcd499496c301cf09a25f312a93a03edcd
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aDB2.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aDB2.bat
                                                                                                                                                                                                                                                                                • Size 721B
                                                                                                                                                                                                                                                                                • SHA256 2b731c784ef2bcc6c7e5f9de1558fa286ccfcf553632e0c6e8fa6faa6ac5d527
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aFA97.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFA97.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 efee03d1bade8f79a0d6081a537928ee29b621beeec0b5ba5038ca241626c7a9
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 4720996c335483a69a897d679e350b548314e720cc7a2018926d2efe3f080360
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                • SHA256 19e9ed3fe384611c0bd544632caa36b345312355aad1480a3399a444d46d4a67
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                • SHA256 3e7471f2d44db4345625662336a871392b68565246aa30388e617254cb248a4d
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                • SHA256 40e69dc3f20f46a407429f9497a7d4f2af3d5c3a8a6d971b89f31d8fdfff8a2e
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                • SHA256 fb2e6078846ae9da8ce6faf862ac6eecd28512fcae610d3e73e8251405ae001c
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                • SHA256 33b84516f10ac5da332a25559063001cd0a2a59f3fd6d457b33763ba75f4097e
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                • SHA256 0d04cb8c5728f0db74a3345fdf0e83ffcd1b7f423a32062e967fdb9f5cf43f80
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                • SHA256 bb72b9ca657b2e11b57897757fcac6b220949bf46f204b83dfff485b553a2d30
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 57541a9b3c63bd165fd18fd851e1de71fcea01aa02844b636e81c4ffce840389
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 b3835f847ecc618940ffa0dbcb89842cc46f838a749f6f0b6a8eeb93a228e6ec
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 a8fc2614b21bf2da9c4c96a84928cd427284b029b2387c7119d5f81413387395
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 28e7ad440746d5b7cc15d86558a9a4cf02e6deb443c9474df414fa2f2aebb8fd
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 3478d056b66db33fe331c4984787b2948279501c3a911043fec1023da0ba5ad7
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                • SHA256 9f9650df83d0c70206e3f375e22cf9a983e2dde698a7c8150980004168cc9e1c
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                • SHA256 b860892a0523a3f9ebcbee4f5fd749599fd99a54aab6e0847cc21c21087c6219
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                • SHA256 907096c3a5dc6d049c2ad7481ea8474da38e1705a9a757f13dd85a5ff703cfdd
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                • SHA256 199b788b5a2eec1287783fc5ad933742c389d4362849a3024a1d06754c92f61f
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                • SHA256 e9c5faefb5d08d6941d318a8bbe20948abf75bd0c9a8b97e095718b1de55d4f0
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                Dll.dll
                                                                                                                                                                                                                                                                                • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                • Size 68KB
                                                                                                                                                                                                                                                                                • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-2101206053-1414382737-268919432-1000\_desktop.ini
                                                                                                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                                                                                                • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                memory/64-1036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/212-1332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/372-1357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/384-1142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/456-1252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/536-1402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/544-921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/664-1292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/696-1024-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/868-870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/868-878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/868-844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/868-869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/916-1072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/944-1262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/976-1553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/980-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/980-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/984-1056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1000-1113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1036-1302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1056-1427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1060-1125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1080-867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1084-1568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1096-1513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1120-1232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1176-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1176-833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1192-1016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1268-1453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1420-30-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1452-1422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1484-1004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1500-1297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1564-1412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1656-1322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1688-1442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1744-1227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1768-1337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1892-1085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1916-1397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1928-1020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1948-1101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1980-1052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1996-1367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2004-1008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2016-906-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2096-928-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2152-1064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2240-943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2252-1573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2260-1407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2328-1282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2360-1040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2368-1377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2404-1473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2412-1437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2428-959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2428-955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2488-1202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2496-1192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2504-1488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2516-1089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2524-1172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2540-1212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2548-1543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2568-1060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2576-1312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2588-1417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2668-968-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2792-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2796-1077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2824-1044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2880-1247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2896-860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2896-856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2960-1157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2968-1237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2988-984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3012-884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3036-1483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3044-1327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3092-1538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3152-1177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3200-1197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3228-1137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3268-1498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3276-980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3300-1242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3400-1117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3460-1468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3488-1105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3520-1028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3524-1133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3580-972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3644-1068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3648-1217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3656-1207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3744-1352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3788-1563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3812-1187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3832-1347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3856-891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3860-1503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3880-1307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3964-1257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3980-1463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3984-1342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4008-1447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4028-47-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4068-1097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4072-1382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4092-1392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4156-1493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4160-845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4188-913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4192-1528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4200-1372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4232-1267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4268-1147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4292-1458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4300-1432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4304-1518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4324-1272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4340-1162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4352-1317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4400-1129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4424-992-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4432-1121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4436-947-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4436-951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4464-1093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4472-1523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4484-1533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4496-1558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4536-1222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4600-1109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4612-1387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4620-1032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4668-1548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4676-1182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4716-935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4768-976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4776-876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4784-1000-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4812-964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4860-1478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4864-1362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4896-1081-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4904-1012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4936-1277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4940-988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4964-1152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4972-1287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4996-1167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5008-1048-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5012-1508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5024-996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5112-898-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download