Overview

overview

8

Static

static

3

56acedbfd5...cb.exe

windows10-2004-x64

8

56acedbfd5...cb.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 06:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
  • Size 5.8MB
  • Sample260930-g757jsvard
  • SHA256 56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3124
      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3968
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81C9.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4968
          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:992
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a867C.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1444
              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5756
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AA2.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2732
                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1564
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8ED8.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2316
                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4712
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9253.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2460
                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5516
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EE6.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5244
                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4664
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA222.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4732
                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:1264
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB397.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2488
                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:5984
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA6D.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4648
                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:5744
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE26.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2660
                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:1228
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1DF.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5732
                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4348
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC569.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6032
                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3108
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA0D.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4268
                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4920
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD78.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5928
                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5140
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD102.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2696
                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3052
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4EA.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2052
                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3816
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD836.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2968
                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3028
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB91.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2596
                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1856
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE7F.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2144
                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5612
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF79.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3372
                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5468
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0A2.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3232
                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:6020
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE19C.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4692
                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5592
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2A6.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:6072
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2784
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3BF.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4816
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4356
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4B9.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4508
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4608
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE601.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5840
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1648
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE739.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1668
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2328
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE891.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1896
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:1868
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9CA.bat
                                                                                                                          60⤵
                                                                                                                            PID:5908
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:5472
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAD3.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:4548
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:2580
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBDD.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:4280
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:1996
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECF6.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:3796
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2484
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDE1.bat
                                                                                                                                                68⤵
                                                                                                                                                  PID:5348
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                    69⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3252
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEDB.bat
                                                                                                                                                      70⤵
                                                                                                                                                        PID:2576
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                          71⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:1504
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF032.bat
                                                                                                                                                            72⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3972
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                              73⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1456
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF13C.bat
                                                                                                                                                                74⤵
                                                                                                                                                                  PID:3932
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                    75⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:2472
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF284.bat
                                                                                                                                                                      76⤵
                                                                                                                                                                        PID:3948
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                          77⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1524
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3DC.bat
                                                                                                                                                                            78⤵
                                                                                                                                                                              PID:1076
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                79⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:5148
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4E5.bat
                                                                                                                                                                                  80⤵
                                                                                                                                                                                    PID:1300
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                      81⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:5232
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                                                                                                                        82⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5464
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                          83⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:2860
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF737.bat
                                                                                                                                                                                            84⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:2588
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:1604
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF841.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                  PID:6116
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:3300
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF93B.bat
                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                        PID:3732
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA35.bat
                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB4E.bat
                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                    PID:3188
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:5772
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC38.bat
                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:5352
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD32.bat
                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                              PID:4612
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:3760
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE4C.bat
                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:2716
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF46.bat
                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:2868
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11.bat
                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:4604
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3900
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12A.bat
                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1116
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:3500
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a214.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                    PID:4140
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:5604
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF.bat
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:1448
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:2800
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AB.bat
                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:5856
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:3256
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a485.bat
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:3800
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57F.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:4728
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a699.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                          PID:1396
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:5392
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a793.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:1500
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:916
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EA.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:4560
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:3320
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA04.bat
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                        PID:3620
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:3560
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2D.bat
                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:1880
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC07.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:2400
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:4812
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD30.bat
                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                      PID:2360
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                          PID:6140
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFB.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                  PID:5028
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF15.bat
                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:5876
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:4088
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFF.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                          PID:1480
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                              PID:4404
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1109.bat
                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:2828
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                                    PID:5424
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1212.bat
                                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                                        PID:5160
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                                            PID:5944
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12ED.bat
                                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:1924
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13F7.bat
                                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5016
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5372
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1500.bat
                                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:3244
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1976
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15CB.bat
                                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1568
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16A6.bat
                                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4232
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3752
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17BF.bat
                                                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:1384
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:708
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18B9.bat
                                                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:3136
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2744
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19A4.bat
                                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:4360
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:860
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B78.bat
                                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C92.bat
                                                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:240
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20E7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2210.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2397.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a280B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2924.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C80.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E93.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a320E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3346.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a347F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a354A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3634.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a376D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3876.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3941.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A6A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DA6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4066.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4140.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a424A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4334.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a444E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4548.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4603.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a471C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4807.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CE9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DE3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5063.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a511F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5361.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a541C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a568D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5768.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BCD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CA8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F19.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6003.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6274.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a634F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a641A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a668B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B2F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BFA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7001.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7159.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7205.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a730E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1892
                                                                                                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                  PID:1204
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                    23⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                    PID:3308
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                            PID:4276
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                              PID:3240
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:4956

                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                $$a7DA2.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 6c72d757e5957036d994aba8c48a04b5d89b1aa624babb5026dfcc50fe83a2aa
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a81C9.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a81C9.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 d1c1bc7a31b990e91b39d4f417ddc69cb4728029e01a2b1bd260fa7dae79dd10
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a867C.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a867C.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 ae50ad6697b575f87ae044faabb11ff9555f96a452216cb2bf696f26a85e6f45
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a8AA2.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8AA2.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 a5e6747d4d7abf34297b70993ca3e8ce480da2b444467910ad7869a0f27d7eb8
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a8ED8.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8ED8.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 c8e0fab0f803502d6807c36753f48e314c6ab70084ac83c9e9012e02f76db9cb
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a9253.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9253.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 f7f48f6845e87a115b14d59ca610c372f62b11bc45f625b955044665da80c050
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a9EE6.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9EE6.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 76d5dc37154dbb91c0a95063867956602a14eebedff9fe59b2364ceeffa05d9e
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aA222.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA222.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 ac11d49a7b2b333818b96a32e29bdf04dd579a9dfa5d3d8aa8a33917488f5de2
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aB397.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB397.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 d9b21b242f8275f8f8ddb87983391dc04e2349908e93951968dfdfd57945762b
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aBA6D.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBA6D.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 0e146a10b507dcba3d7e35a11742f5acb58c3fd43420d022018c2701f14a3b0d
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aBE26.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBE26.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 8f8571d6550b8c820717d665a54328c2ebde5e0da0ee7bf7748dd91210cdf7ca
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aC1DF.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC1DF.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 8f3ece6bf904d3b8225abdc2f2a31853469c68e6018ffbf245e0299d2a6b1e56
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aC569.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC569.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 518d0d8146815b05cba53424a00047e9011649b6a5a7203d3a166be746126851
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aCA0D.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCA0D.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 f7c6cd8888419a5c55cf1f3314bdd6cc4705dee44633ba97f2db7c873ec9eb83
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aCD78.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCD78.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 58b12e99faf6cc16098fbf327b1472ebc2d6163140f02ef24e04c93892a52dee
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aD102.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD102.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 d7b71598819d5cd6ea70feb04c3f6ee1cfbd98f2cd85bf0ebec2c508dabf0f10
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aD4EA.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD4EA.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 d346734a03292a7574b7b0836fa4641ec24f775cdb4515ebb147146a72193247
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aD836.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD836.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 1283a9a65650c62f0a7576a453a9e72f940b92d64fc760c7cef34d9e2e9a57e7
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 712afa4dcf21d3b9216f9cb58ff35be18474954790df78c58d77ee80e29d5564
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 de90399330e5b897f6721028888f1fec93e375cdf6a03156e806dfe90b6ccc07
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 ec83fa17d5c27377b0510225f0a32dd9ab9b25dd1efd2b69b2136f3c0e67cf38
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                • SHA256 0b10f83a6dd91675d864b013dd9a6c752ac9d6ad9206d077cbbd33e08ec261c5
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                • SHA256 bedc67ac7086097aed9749728239b5d00c763979d23cdfee2fc02daab0174871
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 3c32d595749a769f0353eda83ac028892812241e2faf32036f0f44a9ada71c64
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                • SHA256 13ec3c098d94e1aa30dccbd27496ace932c631cf9102227b9c68956cdac32d79
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                • SHA256 b066a7f8d199349e1e11d63fd6a1e0e01cb2738dd4d8cd911932e6203dcc1562
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                • SHA256 47e105196e2b79a5bf160697990825eba4f2a8007b13397b08e15ef278fc61eb
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                • SHA256 7fae5b7d7bbaf3145c63e1f302f8fe5ddde25ed09cef76d1dedcce0f96222010
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                • SHA256 fe0af440f916901bfbfb024ded35094dbea3106de148ae358615a9e363599479
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                • SHA256 12914af7f046c89f55d245100aa4391de95706c1f891367ef2a259ee945583cf
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                                                                • SHA256 a6f477981503452599999ee7c060b5dc2f53397b1c15ce9e3cf977e61af0fbb9
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                • SHA256 b99a344eee98fafdb80f53be6094d552c8fabceebda8909dd5710ec1da3f9339
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 b28fa5a001f9e985ef0af9702c328f6089c8e91e639b904817983b25de3c90b4
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                                                • SHA256 8846ae5a47eaa6453f25f2441a6e6d99b9848308f361f861fe4bcd3d73d639d6
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 955225962cac37d48426b4ec8bd6e665c82a04a40061e0b7d3b61aa4edcd3cc0
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\56acedbfd5bb2ec083e37895e8d8af88b29db8292c3f745dc8094f267464eecb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                                                                                • SHA256 800b62019b2a7e10574afbc5a6e27fe08a7ac4ea914a6a7febd4b112b26f0e19
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                Dll.dll
                                                                                                                                                                                                                                                                                • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                • Size 68KB
                                                                                                                                                                                                                                                                                • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\_desktop.ini
                                                                                                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                                                                                                • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                memory/204-6407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/236-6377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/708-5949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/860-5961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/916-5855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/992-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1148-6003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1152-6154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1204-5649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1204-5685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1228-5588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1264-4853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1332-6268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1400-6142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1456-5740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1496-6256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1504-5735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1524-5750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1564-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1604-5770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1612-5985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1648-5695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1800-6244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1808-6220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1844-6166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1856-5654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1860-6232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1868-5705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1880-5870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1924-5919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1952-5937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1976-5931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1980-6208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1996-5720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2220-6039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2256-6172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2280-6081-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2328-5700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2388-6021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2408-6148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2472-5745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2484-5725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2516-6051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2520-6118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2544-6202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2568-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2568-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2580-5715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2604-6395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2712-6371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2744-5955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2784-5679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2800-5830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2804-6413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2860-5765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2956-6124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3008-6196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3028-5648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3052-5632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3096-6304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3108-5608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3212-6075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3248-6087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3252-5730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3256-5835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3300-5775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3316-5979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3320-5860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3328-6045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3364-6057-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3384-6027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3388-6112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3428-6238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3500-5820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3560-5865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3752-5943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3760-5800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3800-5840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3816-5640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3900-5815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3916-6401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3968-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3976-6383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3980-5997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3984-6226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3988-6250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4088-5895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4100-6184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4116-6365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4240-6009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4260-6292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4276-781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4276-5565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4276-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4276-2495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4296-6069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4304-6100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4320-6346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4332-6136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4348-5598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4356-5684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4404-5901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4416-6160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4444-5810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4488-6093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4500-6316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4544-6274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4608-5690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4632-6310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4664-1841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4672-6334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4712-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4728-5845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4760-6106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4776-6298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4788-6286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4812-5877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4852-6214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4872-6063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4900-6322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4920-5616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5028-5889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5044-6262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5064-6353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5096-5785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5104-5780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5112-5805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5128-6328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5140-5624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5148-5755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5164-6389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5232-5760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5240-5973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5308-5991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5320-6340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5352-5795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5372-5925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5392-5850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5412-6015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5424-5907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5468-5664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5472-5710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5500-6178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5516-1833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5548-6033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5592-5674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5604-5825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5612-5659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5620-5967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5744-5577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5756-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5772-5790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5916-6130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5924-6280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5932-6359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5944-5913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5984-5561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6020-5669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6124-6190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6140-5883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download