Overview

overview

7

Static

static

3

9a753cb7a6...b3.exe

windows10-2004-x64

7

9a753cb7a6...b3.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 00:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
  • Size 5.6MB
  • Sample260930-basbjavdna
  • SHA256 9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a696E.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5600
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E41.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1776
          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4360
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a716D.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:6084
              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:1064
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a747A.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5928
                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5704
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7788.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4824
                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:1896
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A85.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3916
                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:4964
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4208
                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1436
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87A5.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:2876
                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4992
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A64.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4988
                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:6080
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a909E.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3708
                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2640
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9754.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:1264
                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:1516
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E88.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4492
                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1860
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA118.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3984
                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5744
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6E5.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2644
                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4608
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA936.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3292
                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4592
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC24.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4512
                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4412
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5544
                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:420
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB75F.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4900
                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4312
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA3E.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2784
                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4716
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD0D.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:6032
                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1420
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFEB.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2612
                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:936
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC20E.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2376
                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2176
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2E9.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:6136
                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1900
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3E3.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3160
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3480
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4CD.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3732
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1544
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5E6.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5324
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1616
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6C1.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4620
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5228
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC79C.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2248
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4664
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC857.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2328
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3516
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC922.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5660
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4380
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9ED.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2468
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5132
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAD8.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:5596
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:6140
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBD2.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4700
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3228
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC9D.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:4648
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:3464
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD68.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:1036
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:5832
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE33.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5092
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2256
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEEF.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:5520
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5400
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFC9.bat
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:1968
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:2520
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD095.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:2020
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:2364
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD16F.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:3016
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4428
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD25A.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:2856
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2596
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD334.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:1288
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:1392
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD42E.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5052
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3192
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD519.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:1772
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:5972
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5D4.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:5752
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:5700
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6AF.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:5408
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7B9.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:1152
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:1144
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD893.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:5996
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:3936
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD94F.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:4440
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:4848
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA0A.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                PID:5412
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:720
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD6.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:2548
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2708
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBB0.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                            PID:1336
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:2236
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC8B.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                  PID:5900
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:2228
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD95.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3560
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:3452
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE6F.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4188
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:5944
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF69.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                PID:6048
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE035.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4744
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:948
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0F0.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:2908
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1BB.bat
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                              PID:944
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:5060
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE296.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:1060
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:3588
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE351.bat
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:3280
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:2628
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3FD.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4B9.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:2424
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:1300
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE565.bat
                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:1088
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                        PID:3700
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE611.bat
                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                            PID:1812
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                PID:1960
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6EB.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:3716
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE788.bat
                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                        PID:6128
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                            PID:2992
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE862.bat
                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:4436
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:4508
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE92D.bat
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:1112
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                      PID:4696
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9E9.bat
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                          PID:616
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                              PID:1732
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAD3.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3608
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4552
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB7F.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4104
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:1596
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC1B.bat
                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4812
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED15.bat
                                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6040
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1512
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDD1.bat
                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:3108
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:2660
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE9C.bat
                                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:4292
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2760
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF67.bat
                                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5740
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4724
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF023.bat
                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:5852
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:4432
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF19A.bat
                                                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF246.bat
                                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:200
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF459.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF514.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF69B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF747.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF89F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF96A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA25.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAD1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDBF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFD2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a263.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a466.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a541.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a716.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA71.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC46.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF82.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a102E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1166.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1203.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a129F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a132B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a154E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1687.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1723.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a183C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1984.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D0F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DCA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a203B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2106.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2193.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2210.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a228D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a230A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2397.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2423.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a254C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2056
                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                            PID:4116
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                              PID:2148
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:2228

                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1059

                                                                                                                                                                                                                                                              Windows Command Shell

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1059.003

                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1555

                                                                                                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1555.003

                                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                                              System Network Configuration Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1016

                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                              $$a696E.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a696E.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 2519299a9fcc5b5b266b5b7feb31a4d0000deeed1c75388fc5eaaecde02fcabd
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a6E41.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6E41.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 5e437a4fb8330575ba028b60247f819910ad38880b3ed576b3660b30fe87adcf
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a716D.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a716D.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 5ab4c133663d944899fe13cc1c9b2b1e0e17b9c8f0b8114ef54ec8675920621f
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a747A.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a747A.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 bce5c3dae2080ff8fa8859477c906c7977faa090acec9f9f3647be2db865c3d7
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a7788.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7788.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 d0cc9c14532659d19a4799a5eaa36135675717a75564487d4baa8e8b5206c8a2
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a7A85.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7A85.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 f71e39434dd58275389ea2fe0f13929f69e49d04225f28e20aaabbc94a456c4c
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a7DA2.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 6c1c241003eb7287636083e5f794f170ea16057665781bac8ae57734afcc96b6
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a87A5.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a87A5.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 14111b157d017f6f07b474db982e81f240851e1c44486158fabf98631a7f61c8
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a8A64.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8A64.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 245828310c6f6b37652be681c6ee54b0603320be01f2a0d9042784a22e0cf517
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a909E.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a909E.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 0dda17a9db67dce7462ecc7794c15e590f38d848ceebc5dd4eb0e885dc83751e
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a9754.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9754.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 4a6bc64a4475be5a362132635a0da1ac4efdafca8c620aba0f6561403abeecfa
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$a9E88.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9E88.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 27bac6a5ca54df0add94b87bd066169d62848ae8ed4fa5caed4e3352b23b521f
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$aA118.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA118.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 9d424aac8058d03af75feaae14d6329f4dbb0db02644130c95779b4c02cc70ca
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$aA6E5.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA6E5.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 f3c6da7361ef3663f680b344e1b08c5580e167e728184873f6e89f0b4b14bfd7
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$aA936.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA936.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 6a26b933af3eca0b1b6c64d490ec6bd1212c586030eb3e02e9cb995e06095c32
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$aAC24.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aAC24.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 46597a64c3d65449445726bd21584022f949e287c87a7904ef763ffcbeb638c3
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$aB1B2.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 4f0054a76decf3ce30b3eb3625dcb75f84de24aecb6a1431e51317dc43a0fe61
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$aB75F.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB75F.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 5ad8faf6a8fbfee073a400c74cc46fb9af8c76085f18fc12806883098bcae926
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$aBA3E.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aBA3E.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 693a3699e7ca5c10f352fce92dd9ef4d7ec7a3e09ced284a536c11d7ab1fbb4d
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$aBD0D.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aBD0D.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 ca7aa3bfa8dabc6832e55a01fca3013f18dbdbbc03ae0b7c8b2b72199a6fdd60
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              $$aBFEB.bat
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aBFEB.bat
                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                              • SHA256 d9f6d37e393ce3e4fba2c172a568b35e40751d2bb6b6d45535f775b0f3b99667
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.3MB
                                                                                                                                                                                                                                                              • SHA256 69cf31d470542dc6f71c81777c6efbbce8979e24d8f1e83a4e7d0ef248b45435
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.2MB
                                                                                                                                                                                                                                                              • SHA256 ad59e2d1bafceeb1616b118368426c295dc5b36d39fac1f655c7391edf1b85f3
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.2MB
                                                                                                                                                                                                                                                              • SHA256 76c1fc0fe2a5a2aaf8c74dac24c87266327075c3793b0ba057e9006ebd65dad9
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.1MB
                                                                                                                                                                                                                                                              • SHA256 47aa6d0611c9de560f09777e7fa4e3be548d2eab326dc84ebdd0f8606a976b16
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.2MB
                                                                                                                                                                                                                                                              • SHA256 c5c3486aac4da9bda248b0e75f752a05424e209e8d1afd87f6b4efe88ae907ec
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.1MB
                                                                                                                                                                                                                                                              • SHA256 4b86e24725f370dcc755611615e59a36c3ab4b134f9f3d0466f58fe0bd2e1b6b
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                                                                              • SHA256 d3bc2cdd3fd8f5e1db36cdbefdb40ce9a144292e6e47c7d15c3d0c7e56b176ef
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                                                                              • SHA256 afe33e33e328be1d38d7dce887aef7d602b1793fc834b75c8e05ce756cdf316e
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.3MB
                                                                                                                                                                                                                                                              • SHA256 5edd40dec454b0c9de23ae36e68c934ce75f06dd1dc072d91ea4cefc17fd8d78
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.1MB
                                                                                                                                                                                                                                                              • SHA256 1345a51c21155925acfe65df448580a05a220a99dad0c7dac09aef8588d1d40f
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                                                                              • SHA256 ae291b125769c737fdd810bfeb8161d566cada2656ebe6b3b839bab4f0d41d82
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                                              • SHA256 42c15a9b164bf62134c8dfb901c7e1555110007080dfd48a9c6ac428984820f8
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                              • SHA256 e5853fd089b9648a81d6d9043a4b5ea85fea798a2491373ec137842724a87752
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                              • SHA256 8dd19d4629f2c2d19e5bc1a06d94b67395258a09a1ab31cde7438089ab7127fa
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                              • SHA256 70b8db3af15bde3850a85af0889d0d3440a7b28c87bc7f0398fb68e72c45eb35
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                                              • SHA256 a954d0be80c7cccee0ac3f86b1869a3751742e91c3d2034ee24fa9b3f5cda680
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                              • SHA256 394b44e4c53c729e54413f6654b6e381c5d8783e7c117ba18d9864cb095b8a63
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                              • SHA256 db65a8ac8db43d0412e995c417f6c13735f792e8a151994bf16470da0f6199c1
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                                              • SHA256 4152dfb75ec9944d4c0ac4587353e98a5f8fec40ff932280212ab813c9b01133
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9a753cb7a6bf60b48b117070d2bd3e48cd2bdefa2a6a7696e6abeca5430bb0b3.exe.exe
                                                                                                                                                                                                                                                              • Size 5.3MB
                                                                                                                                                                                                                                                              • SHA256 b3b2674aeaed7fdc576de9d2bf618e77f9f44054c9e674fe7bd685bf87fae965
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              Logo1_.exe
                                                                                                                                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              _desktop.ini
                                                                                                                                                                                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\_desktop.ini
                                                                                                                                                                                                                                                              • Size 9B
                                                                                                                                                                                                                                                              • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                              memory/200-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/280-8752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/420-8089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/572-8710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/628-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/708-8545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/720-8267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/804-8618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/936-8122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/948-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1064-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1096-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1136-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1144-8252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1220-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1300-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1388-8770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1392-8227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1412-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1420-8116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1436-1840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1452-8818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1508-8866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1512-8401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1516-5238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1544-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1548-8806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1560-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1596-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1616-8147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1636-8648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1652-8654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1656-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1688-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1732-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1760-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1860-5585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1868-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1896-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1900-8132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1912-8662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1920-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/1960-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2028-8842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2068-8812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2176-8127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2224-8848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2228-8282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2236-8277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2256-8197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2280-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2332-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2336-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2364-8212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2520-8207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2532-8680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2544-8624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2592-8698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2596-8222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2604-8722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2628-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2640-3974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2660-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2700-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2708-8272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2736-8686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2760-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2768-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2768-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2884-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2932-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2956-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2976-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2988-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/2992-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3020-8824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3028-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3040-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3064-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3100-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3104-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3192-8232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3228-8182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3276-8794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3400-8836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3444-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3452-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3464-8187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3480-8137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3484-8668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3516-8162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3536-8758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3588-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3700-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3748-8854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/3936-8257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4116-3405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4116-1844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4116-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4116-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4116-8093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4140-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4164-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4180-8575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4308-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4312-8098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4360-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4380-8167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4412-6823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4428-8217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4432-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4508-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4544-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4552-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4556-8872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4564-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4592-6074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4608-6062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4616-8704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4664-8157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4688-8247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4696-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4716-8108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4724-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4736-8764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4812-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4848-8262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4936-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4952-8830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4964-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/4992-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5008-8740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5060-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5084-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5112-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5132-8172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5148-8782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5228-8152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5260-8716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5328-8746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5356-8788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5400-8202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5424-8860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5452-8776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5476-8728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5580-8660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5600-25-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5608-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5644-8642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5652-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5700-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5704-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5744-6054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5792-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5832-8192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5920-8800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5944-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/5972-8237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/6080-2764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                              memory/6140-8177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                              Download