Overview

overview

7

Static

static

3

69cc843874...de.exe

windows10-2004-x64

7

69cc843874...de.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
  • Size 4.9MB
  • Sample260929-rxgrbatv8k
  • SHA256 69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D62.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:6000
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a212A.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2136
          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4748
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a262C.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5228
              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4512
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29A6.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1896
                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5696
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C85.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3868
                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5500
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FD0.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4692
                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2260
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3270.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5572
                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3860
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AAE.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2516
                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:3740
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42EB.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5336
                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3564
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4944.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4340
                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2912
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BF1.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:6032
                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4124
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F1E.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5856
                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5908
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a640F.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5036
                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5456
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a672C.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4808
                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5416
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AE5.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5312
                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5512
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DA4.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5876
                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2476
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79F9.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4500
                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3340
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BED.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4112
                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5464
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F58.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5224
                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4556
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8217.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2292
                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5080
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85E0.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:6008
                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5068
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8812.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2708
                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4412
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a891C.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4328
                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4584
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A25.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5928
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:700
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B1F.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1408
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1288
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C29.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:6128
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1608
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1756
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1652
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4204
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3416
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF8.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4804
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:588
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FD2.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4392
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5904
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90BD.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:3744
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5756
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9198.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:692
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2744
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9282.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:4972
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:6088
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a935D.bat
                                                                                                                                              68⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5232
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2944
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9437.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:2024
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:3236
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9531.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:2728
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:5044
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95FD.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:6124
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5024
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9725.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3156
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:764
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9800.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:2640
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:1088
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98DB.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:2352
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:4580
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99A6.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:3460
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:2332
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A81.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                      PID:3228
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:2740
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B7B.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:4872
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:1892
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CA4.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                  PID:3480
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4980
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D6F.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                        PID:1308
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E4A.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                              PID:4616
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:1472
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F15.bat
                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5728
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FEF.bat
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                          PID:5088
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:5568
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0DA.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                PID:1100
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:4228
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1B5.bat
                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:3420
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2BE.bat
                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2244
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2140
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3B8.bat
                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3288
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA483.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:2336
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:756
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA58D.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:2392
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA658.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:2916
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA742.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                PID:2716
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA81D.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                      PID:4568
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:2480
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8E8.bat
                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:2272
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9B3.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:5396
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:4152
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA7F.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                    PID:572
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:4732
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                          PID:2636
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:1172
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC24.bat
                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:3376
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:2380
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACF0.bat
                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                    PID:1852
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:2092
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADAB.bat
                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                          PID:3476
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                              PID:2408
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEA5.bat
                                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:2880
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:1204
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF61.bat
                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                          PID:3088
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB01C.bat
                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:3856
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0E7.bat
                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                  PID:1628
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:204
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1A3.bat
                                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:2456
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                          PID:244
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB25E.bat
                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:416
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                                PID:1568
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB329.bat
                                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:3060
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2056
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB423.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:2032
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3464
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4DF.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:3436
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:1544
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5BA.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB694.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:1412
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:6068
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB750.bat
                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2836
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:908
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB83A.bat
                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3512
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:4316
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB915.bat
                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5332
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA5D.bat
                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:5360
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:708
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB28.bat
                                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:4992
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC087.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC143.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:916
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC308.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC460.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC52B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC682.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC73E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC809.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC903.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC99F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBD2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD68.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD046.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD131.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD298.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD344.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD577.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD632.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD799.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD855.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD98D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAB6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCD9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE025.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE296.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE332.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE47A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE507.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE594.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE63F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1548
                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Creates a file in the Startup directory
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                PID:3312
                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                  PID:4324
                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:6132

                                                                                                                                                                            Network

                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                  Resource Development

                                                                                                                                                                                  Initial Access

                                                                                                                                                                                  Execution

                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                  1
                                                                                                                                                                                  T1059

                                                                                                                                                                                  Windows Command Shell

                                                                                                                                                                                  1
                                                                                                                                                                                  T1059.003

                                                                                                                                                                                  Persistence

                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                  1
                                                                                                                                                                                  T1547

                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                  1
                                                                                                                                                                                  T1547.001

                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                  1
                                                                                                                                                                                  T1547

                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                  1
                                                                                                                                                                                  T1547.001

                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                  Credential Access

                                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                                  1
                                                                                                                                                                                  T1555

                                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                                  1
                                                                                                                                                                                  T1555.003

                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                  1
                                                                                                                                                                                  T1552

                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                  1
                                                                                                                                                                                  T1552.001

                                                                                                                                                                                  Discovery

                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                  1
                                                                                                                                                                                  T1120

                                                                                                                                                                                  Query Registry

                                                                                                                                                                                  1
                                                                                                                                                                                  T1012

                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                  1
                                                                                                                                                                                  T1082

                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                  1
                                                                                                                                                                                  T1614

                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                  1
                                                                                                                                                                                  T1614.001

                                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                                  1
                                                                                                                                                                                  T1016

                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                  Collection

                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                  1
                                                                                                                                                                                  T1005

                                                                                                                                                                                  Command and Control

                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                  Impact

                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                  Downloads

                                                                                                                                                                                  $$a1D62.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1D62.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 043cebd1001d9745872917e4a8911a1f3f0451f3bec58b89e2aa57353f6c4099
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a212A.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a212A.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 087b90226dc57e0a360f76a1b8f854a1c45f85bedc558ef3c6baf5f2a8579130
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a262C.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a262C.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 823c106c3394ea2826d5081381435abf6368254920cb5e2902fccc5dac9d29c2
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a29A6.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a29A6.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 040d04eed7e999913d3a7bb6e95a3cfefa1bca66ceba0bd50a4d4c70fde9e25c
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a2C85.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2C85.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 e3da109b97a9cd53c23ee4f1e47c63a7680d0df0b2a04a6c2b9af0bda7738912
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a2FD0.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2FD0.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 4acec13b749e8f060498502cdc8198f52864f21d617eb087ea50c0efb9a9b989
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a3270.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3270.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 cc502ba9ebce56df8c45571755cfb94ae477ca3826bebc947a3ea4d37e70f020
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a3AAE.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3AAE.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 6e364631ab8c2c5d3f80bcdc94abf3e71abba84f3c822cd8e0628c6bae5bb631
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a42EB.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a42EB.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 1467cb9dc39243d2151066309544056980200b2c10c9fafe4cee993b20b71d52
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a4944.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4944.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 583710007160e5180779ea898e4b095050438b94a41929283fbabb374c841940
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a5BF1.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5BF1.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 1ccb3d064c1f8a27eda591fa3417beb14bcdd3271adeeb2676f895be1df5996c
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a5F1E.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5F1E.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 e280a137ff3b95b9182990e840dd14c58221ffe5c7880e4dcc369d8f260ecca1
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a640F.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a640F.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 f66509980492f4c865aaac077d03add0cd37ff8472ce9cddadd1c04974f0e7cd
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a672C.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a672C.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 a18f0685d6c01e718445fa6c8a25a7d91a5d28d3fd86e14e79107a7e1dd67863
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a6AE5.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6AE5.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 ed98a0808e52da81015af5fb7d50e53a9e8ce4d27abae7bcd8e3aefcb64fa84b
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a6DA4.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6DA4.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 eba12a640cbc76a97ed153079f1e21d55a87c9db5f599f1222c46178f0ad2398
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a79F9.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a79F9.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 6741d597e1e72c9c37849167d35056cc3d213b7df9590a5af8392dbd2b14a401
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a7BED.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7BED.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 5e51be023aa57907fc2001900a82c9894e85ab27a80ab5accfbe025937e1e7ab
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a7F58.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7F58.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 dae1dbfcce5be9004a161876defa2f39f3d2b427306e525acf3a21de0adaeb0d
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a8217.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8217.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 af6db8da85829084b5e7a5f61a9df6147e29100dae26a2e21840973600820369
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a85E0.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a85E0.bat
                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                  • SHA256 423f4f43dad584d5aefd7b7126e94062e385ceef39058d37f9e33a142a688e98
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.5MB
                                                                                                                                                                                  • SHA256 f1f574896b4d7d8ee32ef406c1d4cbc02b7a2e8156e03685e077e756100a98b6
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.5MB
                                                                                                                                                                                  • SHA256 b2cfd1635e5fe5008dcc7f4da56a7e1b0d12ad442ee130b6c8176928dd66762b
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.4MB
                                                                                                                                                                                  • SHA256 fc2499b231c9052654fd3ddae845eab86fbc567cce7887c51b20897c6a530255
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                                  • SHA256 e35e1a28a7fe18521edfc7247347d5e697fd99624d2ebe8f8596b6710f6563a2
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                                  • SHA256 87e45572236502053012c3f5603de68cd49997f9c990a6b8d3283e747ab55cab
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                  • SHA256 7961735a1ed8e65d7289d640b72009d19352406d770d2fc354cc83f284ddf5e5
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.5MB
                                                                                                                                                                                  • SHA256 14db069d6eb99bc1128e73f94eafa6ffa98ad59e77ff08f96b01f273e8739ea7
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.4MB
                                                                                                                                                                                  • SHA256 2dda445f9c79b1001fed8bbfcc418efc3587d10d88328db995cd529046ffe26d
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                  • SHA256 7e86bef4bc5649ef392fa59a65bcae9ba932fc12ea3fc1458d2a38327560f957
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.4MB
                                                                                                                                                                                  • SHA256 0987f4d6b5c5f5ff557220392b59c196039841aa16a72619c1b9208fc6256e5e
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                  • SHA256 737f8819cfe29441c050e20dd1168165094834558a37e182cf43e23818be5abd
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                                  • SHA256 3e4de16b5ea182eeae1fab8f0d79be01898f8ae8f6d6d7826d097fadaacf1692
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                                  • SHA256 b4249bdb5196f249d37257d441aa932a98d6c21fd4b4d2c8b134a73e084231f9
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                                  • SHA256 8fbe5e71af4485fa8afa7b95649ecfd91c55afc7dceb5399906ff5ca371c159b
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                  • SHA256 7daad69905eb0029a0b76246ac19c0506f99c804b4b033f9eb1e5d838cb4c112
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.2MB
                                                                                                                                                                                  • SHA256 e1e15b7b6c9ad4e8d0f7a14a8adcbedcf7f439b7629f6f8aba6b66eeb361c610
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                                  • SHA256 a3f2939499499920a76819e34e7c3e002390135b161284700d621a7627eedcf7
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                  • SHA256 419ce526aea99f60af3cd02340bf23988f2219a6173cc10ded4a964cbec22852
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                  • SHA256 d996dbba9fe0cae5140d15f14483a834482884f1af2b48c0fa08121614e2cd33
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69cc843874a8e3b959e3a08cb0138f7ad9ea3de10a3a0cf2ad810ffc66d353de.exe.exe
                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                  • SHA256 2c3f40d047b18cd8e9442d0040a4071839888d3af35a93ecb1c94a80fe459b8b
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  Logo1_.exe
                                                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  _desktop.ini
                                                                                                                                                                                  • Path F:\$RECYCLE.BIN\S-1-5-21-4057491610-3392471755-192832105-1000\_desktop.ini
                                                                                                                                                                                  • Size 9B
                                                                                                                                                                                  • SHA256 838cd29e86a897cab4f24311178626216bfb2c78875e82ccad2f629039bcbc8e
                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  memory/204-8364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/244-8370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/588-8161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/700-8136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/708-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/756-8282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/764-8207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/788-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/908-8412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/916-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1080-8695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1088-8212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1112-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1172-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1192-8611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1204-8346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1288-8141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1472-8247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1544-8394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1568-8376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1608-8146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1652-8151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1680-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1692-8780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1748-8683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1892-8232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1996-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2056-8382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2080-8617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2092-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2140-8272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2180-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2236-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2260-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2272-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2332-8222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2380-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2408-8340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2476-8081-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2480-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2512-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2524-8713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2576-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2576-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2712-8768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2740-8227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2744-8176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2776-8707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2796-8653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2816-8641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2860-8750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2912-5347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2916-8292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2944-8187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2948-8731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2972-8756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2976-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3000-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3088-8352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3120-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3188-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3236-8192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3288-8277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3308-8701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3312-8177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3312-1163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3312-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3312-1853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3312-6069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3336-8762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3340-8089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3392-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3400-8787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3400-8793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3416-8156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3420-8267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3464-8388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3560-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3564-2537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3600-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3712-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3740-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3760-8400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3808-8725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3856-8358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3860-742-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4116-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4124-5576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4152-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4160-8297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4228-8262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4260-8719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4264-8786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4316-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4344-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4384-8575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4412-8126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4484-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4512-2423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4512-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4556-8107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4580-8217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4584-8131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4624-8689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4644-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4672-8677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4732-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4748-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4820-8665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4884-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4904-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4936-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4976-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4980-8237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5024-8202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5044-8197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5068-8121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5072-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5080-8115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5144-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5236-8737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5332-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5416-6065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5456-6053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5464-8099-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5500-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5512-6074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5568-8257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5592-8671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5608-8545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5648-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5660-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5696-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5708-8774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5728-8252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5756-8171-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5764-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5904-8166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5908-6045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5996-8635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6000-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6028-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6040-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6068-8406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6088-8182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6096-8659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6112-8743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6116-8647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download