Overview

overview

7

Static

static

3

ea781f1ddd...6c.exe

windows10-2004-x64

7

ea781f1ddd...6c.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 18:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
  • Size 4.9MB
  • Sample260929-w7t7lsdb32
  • SHA256 ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a308C.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3176
      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5936
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3445.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2740
          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5572
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A8E.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:120
              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:5992
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4099.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4512
                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4504
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C32.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3528
                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4420
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5402.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5460
                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3776
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6930.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5624
                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3384
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a715E.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2452
                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3364
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78B1.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5380
                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:1848
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:700
                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:6040
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A64.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3064
                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:984
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D13.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2908
                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:588
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a908E.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2676
                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1644
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9522.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5012
                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4500
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96A8.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5832
                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5896
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99C5.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4792
                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4320
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CA4.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3728
                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5316
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F72.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3524
                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5368
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA222.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2660
                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3948
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA57D.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5452
                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4848
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA80E.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2772
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2232
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAACD.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3220
                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5424
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABF6.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:52
                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:6024
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD1E.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5608
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3288
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE86.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4660
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4476
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF8F.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5264
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2328
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0F7.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3336
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4216
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB220.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4160
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:692
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB30A.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2504
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4852
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1656
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5944
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB52D.bat
                                                                                                                              62⤵
                                                                                                                                PID:1484
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:712
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB685.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:2560
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4956
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7CD.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:1340
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5476
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB944.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:5392
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:464
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA5D.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:2820
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:5404
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4132
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5276
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCBE.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3600
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1232
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDD8.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:1948
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:2476
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                    PID:4144
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:3764
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC039.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4116
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2864
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC172.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5756
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:1852
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC28B.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:4968
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:5628
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3A4.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2900
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3292
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4AE.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                          PID:1672
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:1912
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5D7.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                                PID:5000
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:252
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6E0.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                      PID:2728
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:5752
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7DA.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:1932
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:1936
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8C5.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:2664
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:4120
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9ED.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                    PID:3872
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAC8.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:1476
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2076
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC30.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                              PID:5568
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:2512
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD39.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5948
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:3244
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE24.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                        PID:352
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF2D.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:5500
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:1568
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD027.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1336
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:4188
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD112.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:4780
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1CD.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:4840
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2D7.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:1764
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:4772
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3E0.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:468
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4624
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4BB.bat
                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2716
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:4976
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5C5.bat
                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                            PID:3424
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:1960
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6DE.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:1616
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:5808
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7C8.bat
                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                      PID:4884
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:1056
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8B3.bat
                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:3228
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9CC.bat
                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                PID:6124
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                    PID:3464
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAA7.bat
                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:1240
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                          PID:3512
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB81.bat
                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:564
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                PID:1976
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC7B.bat
                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:4696
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD47.bat
                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:1552
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:1732
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:624
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF2B.bat
                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:688
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE035.bat
                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:2036
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                          PID:2624
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE13E.bat
                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                              PID:2852
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1276
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE219.bat
                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:1416
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4836
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2F4.bat
                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:2156
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:980
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3FD.bat
                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:200
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:1992
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4B9.bat
                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3256
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:5632
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5D2.bat
                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:4592
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6CC.bat
                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:4176
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5708
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7C6.bat
                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:6028
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:3616
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8B0.bat
                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:3732
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE99B.bat
                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:4136
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC89.bat
                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED54.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF042.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF14C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF236.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF320.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF514.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF795.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF89F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF979.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD42.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFED8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a447.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a725.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a810.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a129F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a135A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1474.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a154E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a160A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1752.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a183C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1907.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3892
                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Creates a file in the Startup directory
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:1564
                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:5116
                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:988

                                                                                                                                                            Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                  Reconnaissance

                                                                                                                                                                  Resource Development

                                                                                                                                                                  Initial Access

                                                                                                                                                                  Execution

                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                  1
                                                                                                                                                                  T1059

                                                                                                                                                                  Windows Command Shell

                                                                                                                                                                  1
                                                                                                                                                                  T1059.003

                                                                                                                                                                  Persistence

                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                  1
                                                                                                                                                                  T1547

                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                  1
                                                                                                                                                                  T1547.001

                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                  1
                                                                                                                                                                  T1547

                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                  1
                                                                                                                                                                  T1547.001

                                                                                                                                                                  Defense Evasion

                                                                                                                                                                  Credential Access

                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                  1
                                                                                                                                                                  T1555

                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                  1
                                                                                                                                                                  T1555.003

                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                  1
                                                                                                                                                                  T1552

                                                                                                                                                                  Credentials In Files

                                                                                                                                                                  1
                                                                                                                                                                  T1552.001

                                                                                                                                                                  Discovery

                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1120

                                                                                                                                                                  Query Registry

                                                                                                                                                                  1
                                                                                                                                                                  T1012

                                                                                                                                                                  System Information Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1082

                                                                                                                                                                  System Location Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1614

                                                                                                                                                                  System Language Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1614.001

                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1016

                                                                                                                                                                  Lateral Movement

                                                                                                                                                                  Collection

                                                                                                                                                                  Data from Local System

                                                                                                                                                                  1
                                                                                                                                                                  T1005

                                                                                                                                                                  Command and Control

                                                                                                                                                                  Exfiltration

                                                                                                                                                                  Impact

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  $$a308C.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a308C.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 2bfdd34dad70fb4256ee23d7a5b0f96f1fd0307f55071e530da99f92b39a1950
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a3445.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3445.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 b025530f1f387851ba73bbc2f78092ef4e7a363e8093ba34ccf06db42be48073
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a3A8E.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3A8E.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 15e12a51cb264caf3a26b33f3f81e0c321b13342b28650e69ea976a62f4eec53
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a4099.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4099.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 232bc9566e7e632fddf24d9d4b71bac422ae0a2f92c3943cd74c1a835509fdca
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a4C32.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4C32.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 6dd18be1e94edaaa6f5da3462c51a9ab5744db7fc1c5b52d580371d923665ee3
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a5402.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5402.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 ee3f86d0360cc90120284c405e07da0e4dba28f45066c3bb6b251fa259c9ce47
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a6930.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6930.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 3b534353d7eb24e1f87c255a8e4cd80149b4d0533288935aa3538d1dd5ec7550
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a715E.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a715E.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 b2ccba43e71f1b3201642249b0f98e2857d1be42887a284e33d12ee408cc4eee
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a78B1.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a78B1.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 adb8423a610069dd77e13142c61eeee5b2ce09f4e496dfb8304a54cbedd15517
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a7DA2.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 f65aecf7abb3f4fab7f8deb2f4a92aaabd2116713d47e61d8fa163d85cb197bb
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a8A64.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8A64.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 60b909a681a178c047e3d45620875487c89319b678f1c3a559185006fd598157
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a8D13.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8D13.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 c9ab0c95bb9575e05e4da8a513d898fb293ccf56206139b77afc192b8ffbeae9
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a908E.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a908E.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 01b44e8e751bd5edc7224f7fc5cfd19b1218d386347eb76b1c516d101f4d3d4a
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a9522.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9522.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 f94b443c40eb9bf5e057cc55b7a0e6c650f5ddfa4cf3f65cff7bd84ba3f10249
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a96A8.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a96A8.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 e39ed8e10252ca70639b1dcb5aeb28be854e236d12cceb32290a09355d48bc3f
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a99C5.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a99C5.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 7d6caf23d161888e2ee7e4fd44f1392f6359bea7f7d5f8d37d3cdb56e4cb80e1
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a9CA4.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9CA4.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 c929d74ab2d5ccadfc12b7243a9cd69f8030fc7646ade12c56e3b533842f18e2
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$a9F72.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9F72.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 caa58d5359cd635bc3544c44d40b1df2ad332a8f3a9c91bfcfe1e1d2b220cdcd
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$aA222.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA222.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 798b9fb37112efba86fb50c85c4ef724af3848250ff10f933c338748b716f8df
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$aA57D.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA57D.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 0a13df1b3330e056307b990e14abc4ae78385bcb15d67ba18436f303fff9459c
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  $$aA80E.bat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA80E.bat
                                                                                                                                                                  • Size 722B
                                                                                                                                                                  • SHA256 25476a91f2bc4c0039617fe8294fca1628099661a2f464bc01101895644e772d
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                  • SHA256 c57a255ca2d2841a57ab9b799fdea24377a01f84ac5415b10ec4a2a7f92c2209
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                  • SHA256 325364a646cd34aa6ab8e03b0207a6a01b87175ea21e10dfe851050171fd79cb
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                  • SHA256 779790e5c2ece525266c0ecea5f54a45d287ad75e69281df5d665a0ed225c463
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.5MB
                                                                                                                                                                  • SHA256 0438677b41a409137cce8d432c3b78d987246275b685c04d616d85efc91857f5
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.5MB
                                                                                                                                                                  • SHA256 ed589b60cb9c11f5d0904e4e7bd8fe4fd62a5b8e261c33ce9efb86df585f2040
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.5MB
                                                                                                                                                                  • SHA256 c051974809429467dd2b21ae0013d615541fb18e11a2faecd9a617dac320ca04
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.4MB
                                                                                                                                                                  • SHA256 0c55ed1515d729e3f06e5472dcbbb6ea45637057cd966672fc5e538831b65194
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.4MB
                                                                                                                                                                  • SHA256 6159232d4ae0b8745086c0a0145e9985f6aa5c23b1f2ef6ce45b07e900187950
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.4MB
                                                                                                                                                                  • SHA256 d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                  • SHA256 7a2b0ea0d1b2e07d1de304149d866f41be8101fb7103e4f5334958d07b5a325a
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                  • SHA256 4b2ed57f84baefbdb363f4c53f61104c2ec866d6551253fbfbf7f80ab8588b7c
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                  • SHA256 2e76a5df010c1fc92d241b4d0921f3a1ee19bc14f4a70460315e1f26871dba01
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                  • SHA256 936d893a962de1147212d6db794ebef8df83bb9aed1d95b25c5afed3398c54a9
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                  • SHA256 d55f809472e44d6b3408b84ca29227a7012c3b56dcc4e896e31b4b4246f220c3
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                  • SHA256 c85f9969ee07a7489bef5e4f140da0aa2c70386e34d49a0894bbc7eb107eadc4
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                  • SHA256 6efc37587804becca55f6ec9caad1cbb7937d45a768137038336797c30089e22
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.8MB
                                                                                                                                                                  • SHA256 ca053e5d8ae8107489e950e4d78fae04c0e6975528ec7629b757260bc20b7f61
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                  • SHA256 5b0a3ae7bf25ad11d585b8465fbbeb15131de93e0597d148215f5c6dc952d7e1
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                  • SHA256 964a990cd1adb044e8b9403e0cc48854dbabae9baa2cdcee2f01635f24c28170
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ea781f1ddd841255295a8a92a4d1edfb073d9b3a1bfea6ff822c882aec10d96c.exe.exe
                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                  • SHA256 0c69dafa403d537f60292c29d7e81c2caecb701f03b1d0a686eac3611a4041a4
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Logo1_.exe
                                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                                  • Size 32KB
                                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  _desktop.ini
                                                                                                                                                                  • Path F:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\_desktop.ini
                                                                                                                                                                  • Size 9B
                                                                                                                                                                  • SHA256 838cd29e86a897cab4f24311178626216bfb2c78875e82ccad2f629039bcbc8e
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  memory/204-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/252-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/464-8159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/588-8022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/624-8349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/688-8355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/692-8129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/712-8144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/980-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/984-8012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1044-8686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1056-8307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1104-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1196-8722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1232-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1248-8698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1252-8728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1276-8367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1364-8439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1424-8614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1480-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1540-8451-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1548-8680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1552-8343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1564-1589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1564-8082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1564-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1564-6370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1564-2444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1568-8260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1620-8740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1644-8030-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1796-8656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1800-8554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1848-6026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1852-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1912-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1936-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1952-8590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1960-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1976-8331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/1992-8385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2076-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2176-8578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2232-8093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2324-8638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2328-8118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2372-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2408-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2476-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2512-8245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2552-8469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2592-8710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2624-8361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2672-8758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2732-8716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2828-8620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2832-8596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2864-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2912-8415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2956-8668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/2980-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3004-8481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3080-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3124-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3204-8500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3228-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3244-8250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3288-8108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3292-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3340-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3344-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3364-6014-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3384-5545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3464-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3476-8632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3484-8457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3512-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3616-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3676-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3764-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3776-4714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3804-8475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3844-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3856-8445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3948-8078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3964-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/3964-8765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4088-8463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4092-8752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4100-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4120-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4140-8337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4168-8427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4188-8265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4212-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4216-8123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4264-8433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4268-8662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4284-8704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4320-8054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4376-8524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4384-8626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4396-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4396-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4420-1825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4436-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4476-8113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4500-8038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4504-1135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4604-8608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4624-8285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4680-8746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4716-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4772-8280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4836-8373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4840-8275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4848-8087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4852-8134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4872-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4936-8764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4944-8397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4956-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4972-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4976-8290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5192-8421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5276-8169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5316-8062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5348-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5368-8124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5368-8070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5404-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5424-8098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5464-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5476-8154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5572-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5628-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5632-8391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5708-8403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5752-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5764-8548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5772-8255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5808-8301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5896-8046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5936-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5944-8139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/5992-52-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6024-8103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6040-7918-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                  Download