Overview

overview

7

Static

static

3

ba23283cfb...4f.exe

windows10-2004-x64

7

ba23283cfb...4f.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 01:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
  • Size 4.8MB
  • Sample260930-by8nesss5n
  • SHA256 ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5940
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1246.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3584
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1999.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3236
          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2988
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D71.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4996
              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2316
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2234.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2620
                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4428
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a260C.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1528
                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1240
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DBD.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4924
                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1816
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3ADC.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5708
                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4912
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F90.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1248
                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3296
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43C6.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4508
                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:1108
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a478E.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:2508
                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:2556
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B48.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2248
                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4620
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F01.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2016
                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3016
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a547F.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3940
                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4608
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5877.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:6084
                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:924
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C01.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1428
                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5396
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F4D.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:700
                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5336
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6383.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4460
                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4236
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68E2.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4272
                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:6056
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B62.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4876
                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4772
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E21.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2468
                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2180
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FE7.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4356
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:696
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a716D.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3132
                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3976
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72E4.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:6116
                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2064
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a745B.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1112
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4128
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75A3.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4796
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:6032
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:6064
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3520
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78D0.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2476
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4720
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A18.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1104
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5976
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BAE.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4592
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2184
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CD7.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:2068
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:5340
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E4E.bat
                                                                                                                              62⤵
                                                                                                                                PID:3692
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:2952
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F96.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:4300
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:2240
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80FE.bat
                                                                                                                                          66⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:912
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1156
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8255.bat
                                                                                                                                              68⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:932
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5232
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83BD.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:4808
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:5624
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8514.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4684
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:3140
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a866C.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:3644
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:2768
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87C4.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:5592
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:2364
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88CE.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:2388
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:3440
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A16.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:3268
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:5748
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4316
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:1736
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2376
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:5124
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E2D.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:1960
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4688
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F17.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3048
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4672
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9011.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                              PID:5460
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:3848
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9149.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                    PID:5152
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:3948
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9224.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                          PID:4180
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:3864
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a938C.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:2544
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:4828
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94A5.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:4432
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:3336
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a959F.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:5964
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:2548
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96E7.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                            PID:2572
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:5208
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9810.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:1544
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98EB.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:5656
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4212
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99F4.bat
                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:4324
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AFE.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1572
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:1308
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BE8.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1496
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:5008
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CE2.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                        PID:3228
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:3604
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DEC.bat
                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                              PID:3276
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:4552
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ED6.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:2280
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FD0.bat
                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                        PID:1140
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:4584
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0DA.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                              PID:1436
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:260
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1D4.bat
                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:4940
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:3308
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2CE.bat
                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3A9.bat
                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                            PID:2580
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3372
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA493.bat
                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:3724
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA57D.bat
                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:4836
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA658.bat
                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:1328
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:5600
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA742.bat
                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:2084
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:1564
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA84C.bat
                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:3024
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                      PID:2872
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA917.bat
                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA11.bat
                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                  PID:3040
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                      PID:3460
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAFC.bat
                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:2532
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                            PID:5984
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABC7.bat
                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:5844
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3264
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACB1.bat
                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:768
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:1712
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD9B.bat
                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:5356
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:3028
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE86.bat
                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:3076
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2188
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF80.bat
                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2232
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:5156
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB06A.bat
                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2044
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB193.bat
                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5332
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB27D.bat
                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:3944
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4692
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
                                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:1764
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB443.bat
                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:476
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB52D.bat
                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB77F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB869.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB953.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC087.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC162.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC327.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC431.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC50B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC605.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC896.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC942.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD87.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF0E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFD9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD095.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD18F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD24A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD315.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD47D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD519.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD690.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD73C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD826.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD901.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD99D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA68.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCBA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE02.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDECD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE015.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5072
                                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                                26⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                PID:6076
                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                  27⤵
                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                  PID:5000
                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                      PID:2280
                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:588
                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                    3⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:4756
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:3840

                                                                                                                                                Network

                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      $$a1246.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1246.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 367931349afa42135bd9636f0335f00b83830c0e89d0d22978d560309e6835e5
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a1999.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1999.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 008d77a3290a2bbb5c664dde3dce3b88fcb55e8517fc8be6bb749f1e0eed8676
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a1D71.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1D71.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 6204d08d2b585690703210675736eb32028eb3594ec49d632ba32e0ce4ec9d1b
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a2234.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2234.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 f5f66715ef10e190cae6699d0cb9eed402e5d149a0a10380898375e3b79d8763
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a260C.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a260C.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 4d2a3ce0c332299aa007cbb194b47b3ff2398dff2676e5a731b62516181015f0
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a2DBD.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2DBD.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 cb1ba2a6a7ab52d7ef1c87f8fa65932e1fc2ca18b1beb9f7b4d8dc950101e3a7
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a3ADC.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3ADC.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 186465c33e7dc9ea66bc130561aab4bf4cfda73dce8e0a688dcf5450d0469585
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a3F90.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3F90.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 42993d3368b8a921ed9c5cc3b8f62018f900517984fc2be26283a36f572e0339
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a43C6.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a43C6.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 463f7f9ad03873161300d17032df5b22e5e038f0fa5a5b881f883992e22fe7ef
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a478E.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a478E.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 71e5d5de37fefcc13db5fe507610cb4eb42ab2d3e21f4e238d375d5246238acb
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a4B48.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4B48.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 587ec87b5bea71a848e019adca71102f782dd7eb2810e9a8a15a92fbf36d1c4e
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a4F01.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4F01.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 ca281b08893266dbc5280c99173de3682e436f5581779fe1a49d501ce3da33ee
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a547F.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a547F.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 d774158c4fa9d79541c8f969a679ff8ab7acade19ec7ca9c72126c35f74defb2
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a5877.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5877.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 9c7292262310af795970de007a60a9df40cb362c3a6ffb5f1cffcbae5ee9b485
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a5C01.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5C01.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 875d13067033e020e366a6c3f78eb70e4352323febe62e4653432d9ec86893de
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a5F4D.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5F4D.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 c1a2d4262b686f8ff27afecff59bae0c8fdddb6444d535c44aefafd7216b00a5
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a6383.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6383.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 9ff75f129602bb7379d80b28cc6b2cf64a3cd0606cdc2334cd271b402fb3f794
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a68E2.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a68E2.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 83102cc1a8e244dbc933caa3893878b60fc3f13a931c188d4efd7b81ee789808
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.6MB
                                                                                                                                                      • SHA256 b5d6e91a6d03c7e75cd0f62ba9ae951bc8d781225b0ef63b69c15fc9845ccfbd
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.5MB
                                                                                                                                                      • SHA256 fa73263ff13246d1147dbb1ae1740ea7da990d2178d4de32489abe844747ddc3
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.8MB
                                                                                                                                                      • SHA256 347b21f66967c5f0ae29e0dc266880b9201553543b20f01085e2c043bf7c3217
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.6MB
                                                                                                                                                      • SHA256 0ec5eff25f046110840bb0a4621524d29d75066ff5ad0874ca6c7a92f53c8f48
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.4MB
                                                                                                                                                      • SHA256 7d5ad6e45475a4b084cdfbb527be43eca30804fb7d124b4520291ca73f801380
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.7MB
                                                                                                                                                      • SHA256 5f1c9737f8c0533ded7e7a1d2432b5d402f26f44b20db88d318b8e7991551fef
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.7MB
                                                                                                                                                      • SHA256 fbf792f45f807d36d416d93ef3747388e62a936d442541435511eb8d4f4dad76
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.3MB
                                                                                                                                                      • SHA256 33fe72eb21d640690b37b1e9257bfceb68ff4d5195e98051f357793748eaf540
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.5MB
                                                                                                                                                      • SHA256 7d3a706345ac50e0f4141b2b0b2588c0bd39c133e642117114a8ec3f6b273e41
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.4MB
                                                                                                                                                      • SHA256 8f04e968c9ce8d2771af9e2c22d47dda7aa48603d996a79127ba0ffc64c1176d
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.7MB
                                                                                                                                                      • SHA256 5236042609a93d6be2cd0f0126843bbfaa4d44c1e4afbc137a14e20014a54618
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.6MB
                                                                                                                                                      • SHA256 0ef685f06ff7a0ccc9d9383aab7da9b5c9aeea211ca984f11553daee64894767
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 261ea2e6a2f8d0e1708bf5e05ed0ae69f0601120819df670377278f03bb49863
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.5MB
                                                                                                                                                      • SHA256 2ee4353a41a86fba77ae53ed3d0c6d47ad7eedab6e1636782fff162f44931307
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.3MB
                                                                                                                                                      • SHA256 044039a68bc2ba41c76cf565a770a689462517dde9b34ab3fdc34149ddf0d0da
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.4MB
                                                                                                                                                      • SHA256 6e9c5dee74470bb313df57c2752bba768a767d391d422973b901091005ce6d0d
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 eeadfe405684c46e46a89bfbf1d6a21e1d04b54c1ccc1a94e8f43095245fa1fa
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ba23283cfb6bb4cd7ef6c28880869a696cbe76fa43624861f12585a54408634f.exe.exe
                                                                                                                                                      • Size 4.3MB
                                                                                                                                                      • SHA256 1c615d491b65227549d654688259bb07fc4ef802d6c6fc66521c562aa07e18f2
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Dll.dll
                                                                                                                                                      • Path C:\Windows\Dll.dll
                                                                                                                                                      • Size 68KB
                                                                                                                                                      • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Logo1_.exe
                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                      • Size 32KB
                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _desktop.ini
                                                                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-2251218687-1689653882-3767565116-1000\_desktop.ini
                                                                                                                                                      • Size 9B
                                                                                                                                                      • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                      Submit Download

                                                                                                                                                      memory/260-1812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/588-1431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/588-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/588-1525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/588-677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/696-1610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/708-2156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/924-1558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1036-2234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1100-2108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1108-1506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1156-1672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1180-1951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1240-279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1308-1782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1316-2228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1432-2192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1468-2114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1544-1767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1564-1855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1632-1975-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1712-1891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1736-1712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1816-1482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1928-2084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2044-1915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2064-1620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2180-1604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2184-1647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2184-1652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2188-1903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2240-1667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2280-1802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2316-52-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2364-1697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2384-1963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2420-2265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2420-2259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2436-2210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2456-1837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2548-1757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2556-1514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2736-2077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2768-1692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2832-2047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2872-1861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2900-2186-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2912-2005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2936-1933-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2952-1662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2984-2180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2988-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3012-2150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3016-1537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3028-1897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3140-1687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3192-2174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3216-2029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3244-2258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3264-1885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3280-2216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3296-1498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3296-1571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3308-1818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3336-1752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3340-2102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3344-2059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3372-1831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3420-2144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3440-1702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3460-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3464-2198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3520-1635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3580-2023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3584-25-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3588-2071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3604-1792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3712-2162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3720-1945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3748-1867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3848-1732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3864-1742-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3892-2017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3948-1737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3968-2053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3976-1615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4080-2246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4128-1625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4212-1772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4236-1585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4252-1843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4324-1777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4388-2041-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4428-62-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4456-2126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4544-1999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4552-1797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4568-1825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4584-1807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4608-1605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4608-1548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4620-1522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4672-1727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4688-1722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4692-1927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4720-1640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4736-2168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4772-1598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4776-2138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4828-1747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4832-2065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4864-2090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4892-2120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4912-1490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5008-1787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5124-1717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5156-1909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5208-1762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5232-1677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5240-2240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5316-2035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5332-1921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5336-1577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5340-1657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5396-1568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5420-1993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5444-2204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5452-1957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5468-2011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5472-1969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5600-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5612-2096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5624-1682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5748-1707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5776-1981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5812-2132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5940-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5940-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5976-1645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5980-2252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5984-1879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6032-1630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6056-1593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6076-1599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6076-1646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6080-2222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6100-1987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6112-1939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download