Overview

overview

8

Static

static

3

b75820faef...62.exe

windows10-2004-x64

8

b75820faef...62.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 23:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
  • Size 5.9MB
  • Sample260929-3mae2atzcs
  • SHA256 b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5620
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E2A.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0CA.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4508
          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2392
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA84C.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5100
              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:3408
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAEA.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1280
                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:700
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2556
                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:6052
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9AF.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5572
                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:6112
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD027.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3916
                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3204
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD651.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4812
                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:5064
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC0E.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5492
                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:880
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE054.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4688
                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2388
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE507.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5920
                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:1096
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE95C.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3568
                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2272
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE0F.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2208
                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3000
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF488.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4468
                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:6036
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB6D.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2484
                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3056
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B7.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5372
                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1724
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a929.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:548
                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1420
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a101E.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3628
                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2708
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1648.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:252
                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5660
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B69.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2280
                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2712
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C24.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4824
                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4356
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D0F.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3176
                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4180
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DE9.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3320
                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4920
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EB5.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5060
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:6024
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F80.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2248
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2352
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a203B.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:840
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5304
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2106.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3512
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3160
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21F1.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:352
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2804
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22CB.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5912
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:5180
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23A6.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:6088
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:1396
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2481.bat
                                                                                                                              62⤵
                                                                                                                                PID:4744
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5568
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a254C.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:4512
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:4308
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2636.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:5232
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4276
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2730.bat
                                                                                                                                              68⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5664
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5024
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27FC.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:824
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:4724
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28F6.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:4212
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:4072
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A0F.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:5848
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1764
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AEA.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:3808
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:2544
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BC4.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:5904
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:5764
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CCE.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:6064
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:2268
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E16.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:236
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:4984
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F3F.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:752
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:6076
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3087.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:2416
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4964
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31DF.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:2896
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2396
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3308.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:2260
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:6032
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3440.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1784
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:5676
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a352B.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:1804
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1772
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3663.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                              PID:5584
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3152
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a377C.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                    PID:5468
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:556
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3886.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                          PID:5352
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2608
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3980.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                PID:1336
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:5416
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A8A.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:2836
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B55.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:1540
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3732
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C20.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                PID:5488
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:5868
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CFB.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3452
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DF5.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:4024
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                            PID:1340
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EEF.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                PID:5952
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:3328
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4017.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                      PID:4252
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:1808
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4111.bat
                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:4764
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:2468
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a425A.bat
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:3700
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4373.bat
                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                    PID:5472
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:1044
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a448C.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                          PID:124
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4776
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45D4.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                PID:4292
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:2956
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a471C.bat
                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                      PID:2560
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                          PID:3804
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4845.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                              PID:2372
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                  PID:2772
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a495E.bat
                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:3036
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:1156
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AF5.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:5596
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                            PID:4860
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C2D.bat
                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:2920
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                  PID:1364
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D46.bat
                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                      PID:5300
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                          PID:5080
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EBD.bat
                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                              PID:5420
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FF6.bat
                                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:856
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5564
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a510F.bat
                                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:5896
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:4196
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5219.bat
                                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:6048
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5324
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5342.bat
                                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4384
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3260
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a548A.bat
                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5692
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:1060
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5593.bat
                                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4552
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:4948
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a568D.bat
                                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1668
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6140
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AB4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BCD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6003.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6207.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6562.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a664D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6727.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a688F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a696A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A44.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AF0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DDE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7011.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7197.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7253.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a731E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a758F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a763B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7716.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7977.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7ADE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DBD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a806C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8108.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a827F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a830C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8454.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a855E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8667.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8713.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a888A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8917.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C15.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E76.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F22.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a903B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9145.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a925E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9368.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9481.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a957B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9675.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a976F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9888.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1180
                                                                                                                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                          PID:3624
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                            PID:4408
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                PID:1932
                                                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                            PID:3520
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                              PID:4304
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:4332

                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                $$a101E.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a101E.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 dde77a493575121d42e727ee930d04a2c6e17d0ceefeaefffe3f5579c752e971
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a1B7.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1B7.bat
                                                                                                                                                                                                                                                                                                • Size 721B
                                                                                                                                                                                                                                                                                                • SHA256 926aa8d59c0768e9cda5cb46349386482bb8bb7cd8a809ae1e0f28d629931e96
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a929.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a929.bat
                                                                                                                                                                                                                                                                                                • Size 721B
                                                                                                                                                                                                                                                                                                • SHA256 d8f5e8b5d847f0a84880eb3e2ef13b8f049be1084961293dc85d82f058a9f143
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a9E2A.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9E2A.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 9ceaa318849c6f707312e1da382fd3bec208e6e289e46a3cb069d83b0656fa4f
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aA0CA.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA0CA.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 cbfd84cb74251ff8932fabc2bada57551127ae4922031c537d41214766b113fa
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aA84C.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA84C.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 7d499c56cedf434a50c290a34273b5a0fb74ed12bd342980c164100a6810c240
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aBAEA.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBAEA.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 bd0e615b39aebf31d34604bf75f81885db7e38cac2394c751f897f9420d543d9
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aC55A.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 282274a1c4b9a01537956fb1ec1731cb61dde682c44b9e006243d8437e81b419
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aC9AF.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC9AF.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 2bd8025368f5e275ec0c4c2aba6e4faa446e694d1698e4364e4ade4430d5f38c
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aD027.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD027.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 ed16ef28f0533ec35dfb0ddd44cc130cb238bb7a5581c51ea6755a067522df41
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aD651.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD651.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 8dda0f13994179f7f4c6b39ae9266a977f71e6ceb707144c4c8d1839d7680d4f
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aDC0E.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aDC0E.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 520f09e19c10ddc7f7491a0fe282440056b60efd3496ea06b2d2ebd95f775c08
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aE054.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE054.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 2cb6ca3597379c0f99acd28b83227e177b18814b755767d46229099f236607ba
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aE507.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE507.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 a9c1bfc59d630ae80db9f6e7503c69242e8812ffd3a90c71c849dc87dcf177a6
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aE95C.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE95C.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 132765783ec2763e55c8206d2291271e7a76afbb1af2fdbe1afd9ee5c407e0c8
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aEE0F.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aEE0F.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 62eb5d54283cf5e01889070db63803a7bc86e979e2f426027cf42a2e7b038b8e
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aF488.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF488.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 80090216488051566bd28f7b1d8b9d3d846c92b45cbe64f7572043788b831eae
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aFB6D.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFB6D.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 bb540eaf009c5df4453bfa9a22680230da684245fdbde88c90796a290cbca19f
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                                • SHA256 3e7471f2d44db4345625662336a871392b68565246aa30388e617254cb248a4d
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                                • SHA256 33b84516f10ac5da332a25559063001cd0a2a59f3fd6d457b33763ba75f4097e
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                                • SHA256 40e69dc3f20f46a407429f9497a7d4f2af3d5c3a8a6d971b89f31d8fdfff8a2e
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                                • SHA256 3478d056b66db33fe331c4984787b2948279501c3a911043fec1023da0ba5ad7
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                                • SHA256 bb72b9ca657b2e11b57897757fcac6b220949bf46f204b83dfff485b553a2d30
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                                • SHA256 b860892a0523a3f9ebcbee4f5fd749599fd99a54aab6e0847cc21c21087c6219
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                                • SHA256 57541a9b3c63bd165fd18fd851e1de71fcea01aa02844b636e81c4ffce840389
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                                • SHA256 19e9ed3fe384611c0bd544632caa36b345312355aad1480a3399a444d46d4a67
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                                • SHA256 a8fc2614b21bf2da9c4c96a84928cd427284b029b2387c7119d5f81413387395
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                                • SHA256 e9c5faefb5d08d6941d318a8bbe20948abf75bd0c9a8b97e095718b1de55d4f0
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                                • SHA256 fb2e6078846ae9da8ce6faf862ac6eecd28512fcae610d3e73e8251405ae001c
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                                • SHA256 0d04cb8c5728f0db74a3345fdf0e83ffcd1b7f423a32062e967fdb9f5cf43f80
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                                • SHA256 4720996c335483a69a897d679e350b548314e720cc7a2018926d2efe3f080360
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                                • SHA256 b3835f847ecc618940ffa0dbcb89842cc46f838a749f6f0b6a8eeb93a228e6ec
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                                • SHA256 28e7ad440746d5b7cc15d86558a9a4cf02e6deb443c9474df414fa2f2aebb8fd
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                                • SHA256 9f9650df83d0c70206e3f375e22cf9a983e2dde698a7c8150980004168cc9e1c
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                                • SHA256 907096c3a5dc6d049c2ad7481ea8474da38e1705a9a757f13dd85a5ff703cfdd
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\b75820faefa1fc97f3da2fa0a5360d05586a1b551c389a4b52ca4245e328fa62.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                                • SHA256 199b788b5a2eec1287783fc5ad933742c389d4362849a3024a1d06754c92f61f
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                Dll.dll
                                                                                                                                                                                                                                                                                                • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                                • Size 68KB
                                                                                                                                                                                                                                                                                                • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-4057491610-3392471755-192832105-1000\_desktop.ini
                                                                                                                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                                                                                                                • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                memory/200-3836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/356-4167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/556-3581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/616-4005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/700-3295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/880-3347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/948-3962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1004-3975-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1044-3637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1060-3722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1096-3367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1124-4125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1128-4161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1152-3932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1156-3667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1340-3612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1364-3679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1396-3485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1420-3417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1464-4053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1580-3969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1724-3409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1764-3521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1772-3571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1796-3854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1808-3622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1844-3794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1876-4041-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1884-4035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1968-4149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1976-4113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2044-3987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2068-3908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2088-3691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2164-3770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2212-3896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2268-3536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2272-3375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2308-4065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2352-3460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2380-3884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2388-3359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2392-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2396-3556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2408-3830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2424-4047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2456-3926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2468-3627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2544-3526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2608-3586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2680-4143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2708-3425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2712-3435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2740-4173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2772-3661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2804-3475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2832-4011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2836-3596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2872-4179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2952-3993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2956-3649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3000-3384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3016-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3056-3400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3152-3576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3160-3470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3204-3320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3256-4077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3260-3716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3276-3842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3328-3617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3388-3812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3408-1808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3516-3920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3520-3297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3520-2729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3520-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3520-3323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3616-4017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3624-3516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3624-3379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3624-3402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3652-4107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3688-3776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3732-3601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3756-3902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3788-3848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3804-3655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4036-3944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4068-4023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4072-3515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4088-4131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4160-3758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4168-4119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4180-3445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4196-3704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4248-4095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4276-3500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4280-3607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4284-3788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4308-3495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4348-4071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4356-3440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4504-4155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4564-3872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4592-3999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4644-4101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4724-3510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4736-3890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4740-3632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4768-3938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4776-3643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4780-4029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4788-3914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4860-3673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4880-3950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4892-3818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4912-4089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4920-3450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4948-3728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4964-3551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4984-3541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5024-3505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5064-3336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5068-3981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5076-3800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5080-3685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5088-4059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5180-3480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5184-3866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5200-3956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5304-3465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5324-3710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5376-3824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5416-3591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5564-3697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5568-3490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5620-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5620-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5644-3806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5660-3430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5672-3752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5676-3566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5744-3878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5764-3531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5852-3764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5868-3606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5924-3860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5932-4137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5948-3782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5988-4083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5992-3740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6024-3455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6032-3561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6036-3392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6052-3304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6076-3546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6100-3746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6112-3312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6140-3734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download